Attack Chain

1. Attacker compromises a cluster worker node through unrelated vectors.
2. Attacker initiates a malicious synchronization request to the master node's MasterHandler.process_files_from_worker.
3. Attacker crafts a path traversal payload leveraging the trailing-slash basename bypass.
4. MasterHandler processes the malicious path, failing to validate the destination against restricted directories.
5. The system overwrites the target file, such as /var/ossec/etc/ossec.conf, with attacker-controlled content.
6. The attacker injects malicious commands or configurations into the overwritten file.
7. The master node restarts or reloads the configuration, executing the injected commands as root.
8. Malicious configurations are synchronized to all connected agents, escalating impact across the enterprise footprint.

Impact

Successful exploitation allows for full control over the Wazuh manager and its downstream agents. As the manager typically runs with root-level privileges, this permits the execution of arbitrary commands across the entire security infrastructure. This results in the potential for complete data exfiltration, disabling of security monitoring, and lateral movement throughout the environment where the Wazuh management plane is deployed.

Recommendation

• Upgrade all Wazuh manager and cluster worker installations to version 4.14.8 or later immediately to resolve the vulnerability in MasterHandler.
• Implement strict network segmentation between cluster workers and the master node to ensure only authorized nodes can communicate with the MasterHandler component.
• Review and monitor file integrity of critical configuration files, specifically /var/ossec/etc/ossec.conf and /var/ossec/etc/shared/agent.conf, for unexpected modifications.
• Audit logs for the cluster communication service to identify anomalous synchronization requests from worker nodes.