Remote Code Execution Vulnerability in Wazuh by Vulnerable Deserialization

CVE-2025-24016

What is CVE-2025-24016?

CVE-2025-24016 is a remote code execution vulnerability identified in the Wazuh platform, which is an open-source solution designed for threat detection, prevention, and response. The flaw arises from an unsafe deserialization process, allowing malicious actors with API access to execute arbitrary Python code on Wazuh servers. This vulnerability can be particularly damaging as it enables unauthorized remote code execution, potentially compromising the integrity and availability of the organization's security framework.

Technical Details

The vulnerability affects Wazuh versions from 4.4.0 up to, but not including, 4.9.1. The root cause lies in the way the DistributedAPI parameters are serialized as JSON and subsequently deserialized using the as_wazuh_object method in the framework's core files. If an attacker can inject an untrusted dictionary into the DAPI request/response, they can create an unhandled exception that allows for the execution of arbitrary code. The vulnerability can be exploited by any user with API access, especially in scenarios involving compromised dashboards or servers within the Wazuh cluster.

Potential Impact of CVE-2025-24016

1. Unauthorized Remote Code Execution: Attackers can execute arbitrary code on affected Wazuh servers, leading to complete system compromise and control over security operations.

2. Data Breaches: The ability to run unverified code can result in unauthorized access to sensitive data, potentially leading to data leaks or theft, affecting organizational compliance and reputation.

3. Disruption of Security Services: Compromised Wazuh instances may cause failures in threat detection and response mechanisms, allowing undetected attacks and vulnerabilities to proliferate, ultimately undermining overall security posture.

News Articles

SonicWall

CVE-2025-24016

Critical Wazuh RCE Vulnerability (CVE-2025-24016): Risks, Exploits and Remediation

Overview SonicWall Capture Labs threat research team has become aware of a critical remote code execution (RCE) vulnerability in Wazuh Server (CVE-2025-24016) and has implemented mitigating measures. Wazuh is...

16 hours ago

References