Description

Wazuh is an open-source security platform providing unified XDR and SIEM protection for endpoints and cloud workloads. In versions 4.2.0 through 4.14.6, multiple active response scripts pass attacker-influenced alert fields to privileged system commands without validating their format, allowing argument injection into tools that run as root. Five of the eight scripts that handle the srcip field, route-null.c, netsh.c, pf.c, npf.c, and ipfw.c, omit the get_ip_version() check that rejects non-IP input, and disable-account.c passes the dstuser field to passwd/chuser with only a comparison against "root". An attacker who can inject crafted log events, for example via syslog, can supply srcip or dstuser values that, when an active response rule triggers, are passed unvalidated to firewall and account-management commands such as pfctl, npfctl, ipfw, route, netsh, and passwd. This enables injecting additional command arguments, and on Windows the unquoted CreateProcess command-line concatenation in wpopenv() lets a srcip containing spaces add further arguments, while disable-account.c can be abused to lock arbitrary system accounts. This issue is fixed in version 4.14.7.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "7.1",
  "pubDate": "2026-08-28T00:18:07.520Z",
  "pubdate": "2026-08-28T00:18:07.520Z",
  "executiveSummary": "Wazuh versions 4.2.0 through 4.14.6 are susceptible to command argument injection vulnerabilities within multiple active response scripts.\nThe vulnerability arises from the insecure handling of attacker-influenced alert fields, such as 'srcip' and 'dstuser', which are passed to privileged system commands without adequate validation or sanitization.\nBy injecting crafted log events—for example, via syslog—an attacker can manipulate the arguments passed to security-critical binaries including 'pfctl', 'npfctl', 'ipfw', 'route', 'netsh', and 'passwd'.\nOn Windows systems, the improper use of 'wpopenv()' and unquoted command-line concatenation further facilitates arbitrary argument injection.\nSuccessful exploitation allows for command execution with root/administrative privileges, potentially resulting in unauthorized system account manipulation, firewall misconfiguration, or full system compromise.\nThis vulnerability is critical as it leverages the security platform's own automated response mechanisms against the host system, circumventing intended security boundaries.",
  "technicalDetails": "The root cause of this vulnerability is improper input validation within several active response scripts (route-null.c, netsh.c, pf.c, npf.c, ipfw.c, and disable-account.c). These scripts fail to adequately sanitize user-controllable input from alert fields before invoking privileged system commands.\nSpecifically, the 'srcip' field is processed by five scripts (route-null.c, netsh.c, pf.c, npf.c, and ipfw.c) without invoking the 'get_ip_version()' function. This omission bypasses the essential validation check that would otherwise reject malformed or malicious non-IP input.\nSimilarly, 'disable-account.c' processes the 'dstuser' field with only a rudimentary check against the 'root' string, leaving it vulnerable to injection of arbitrary usernames or flags when interacting with account management utilities like 'passwd' or 'chuser'.\nOn Windows platforms, the issue is compounded by the behavior of the 'wpopenv()' function, which performs unquoted command-line concatenation. An attacker providing a 'srcip' value containing spaces can escape the intended command structure to append arbitrary arguments to the 'CreateProcess' call.\nThe attack flow initiates when an attacker triggers an active response event by injecting crafted log data into the Wazuh SIEM, typically via protocols like syslog. Once the Wazuh manager processes these events and triggers a configured active response rule, the malicious payload—embedded within the 'srcip' or 'dstuser' fields—is passed directly into the system-level command execution flow.\nThe post-exploitation impact includes the ability to execute arbitrary commands with the privileges of the Wazuh agent process, which typically runs with root or SYSTEM-level permissions. Attackers can leverage this to disable security controls, lock or modify system accounts, or alter firewall rules to permit unauthorized network traffic, effectively turning a defensive automation tool into an attack vector.\nAffected software versions include 4.2.0 through 4.14.6. The requirement for successful exploitation relies on the attacker's ability to influence log events monitored by the Wazuh platform. No authentication is required for the initial log injection if the ingestion pipeline is exposed to the attacker."
}