GHSA-qj88-7rr2-4chx: Wazuh before 4.14.9 SQL Injection via WazuhDBBackend _substitute_params
Wazuh versions from 4.0.0 before 4.14.9 contain a sql injection vulnerability in WazuhDBBackend.substituteparams due to sequential regex placeholder cross-contamination. Authenticated users with agent:read on one agent can inject UNION SELECT via the q and search parameters to extract every agent's internalkey through a blind boolean oracle on totalaffecteditems.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Wazuhto a version that resolves this vulnerability.Fixed in 4.14.9
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An authenticated user who has agent:read permission for at least one agent can exploit it. The issue allows that user to use the q and search parameters to target data associated with other agents.
What data can an attacker obtain?
An attacker can extract every agent's internal_key. Extraction is performed through a blind boolean oracle based on total_affected_items, rather than requiring direct display of query results.
Are default deployments affected?
The provided information does not state whether agent:read is granted by default. Deployments are affected when they run a version from 4.0.0 before 4.14.9 and an authenticated user has agent:read access to an agent.
What should be done if upgrading cannot happen immediately?
Limit agent:read permissions to only trusted users until an upgrade is possible. This reduces access to the required q and search query paths described for exploitation.