Local Privilege Escalation in Wazuh Agent for Windows

CVE-2024-35177

What is CVE-2024-35177?

The Wazuh Agent for Windows is susceptible to a Local Privilege Escalation vulnerability resulting from an improper Access Control List (ACL) in its installation directory. This flaw permits a local attacker to escalate privileges to the level of NT AUTHORITY\SYSTEM by placing malicious DLLs in the installation folder or substituting the agent's service executable with a harmful version. Specifically, if a non-default installation path, such as C:\wazuh, is utilized, the improperly configured ACL permits the introduction of malicious code. This vulnerability, which has been resolved in version 4.9.0, poses a significant risk as it allows low-privileged users to exploit DLL loading mechanisms to execute arbitrary code. All users are strongly encouraged to upgrade to the latest version to mitigate this risk.

References