CVE-2023-50260: Wazuh's vulnerability in host_deny AR script allows arbitrary command execution
First published: Fri Apr 19 2024(Updated: )
Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Wazuh | >=4.2.0<4.7.2 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Frequently Asked Questions
What is the severity of CVE-2023-50260?
CVE-2023-50260 has been classified with a high severity due to its potential for arbitrary command execution.
How do I fix CVE-2023-50260?
To fix CVE-2023-50260, ensure that you update Wazuh to a version later than 4.7.2 or implement proper input validation for the host_deny script.
What systems are affected by CVE-2023-50260?
CVE-2023-50260 affects Wazuh versions between 4.2.0 and 4.7.2 inclusive.
What type of threat does CVE-2023-50260 pose?
CVE-2023-50260 poses a threat of arbitrary command execution on the target system if exploited.
Can CVE-2023-50260 be exploited remotely?
Yes, CVE-2023-50260 can potentially be exploited remotely due to the improper validation in the host_deny script.
- agent/title
- agent/weakness
- agent/references
- agent/type
- agent/first-publish-date
- agent/description
- agent/severity
- agent/author
- agent/event
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/source
- agent/softwarecombine
- agent/tags
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/software-canonical-lookup-request
- vendor/wazuh
- canonical/wazuh
- version/wazuh/4.2.0