CVE-2024-1243: Remote code execution and local privilege escalation in Wazuh Windows agent via NetNTLMv2 hash theft
Improper input validation in the Wazuh agent for Windows prior to version 4.8.0 allows an attacker with control over the Wazuh server or agent key to configure the agent to connect to a malicious UNC path. This results in the leakage of the machine account NetNTLMv2 hash, which can be relayed for remote code execution or used to escalate privileges to SYSTEM via AD CS certificate forging and other similar attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2024-1243?
CVE-2024-1243 has been classified with a high severity level due to improper input validation that can lead to machine account hash leakage.
How do I fix CVE-2024-1243?
To fix CVE-2024-1243, update the Wazuh agent for Windows to version 4.8.0 or later.
What systems are affected by CVE-2024-1243?
CVE-2024-1243 affects the Wazuh agent for Windows versions prior to 4.8.0.
What impact does CVE-2024-1243 have?
The exploitation of CVE-2024-1243 can allow an attacker to leak machine account NetNTLMv2 hashes by connecting to a malicious UNC path.
Who is vulnerable to CVE-2024-1243?
Any organization using the Wazuh agent for Windows versions prior to 4.8.0 is vulnerable to CVE-2024-1243.