{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-50260", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2023-12-05T20:42:59.379Z", "datePublished": "2024-04-19T14:28:20.318Z", "dateUpdated": "2024-08-02T22:16:46.332Z"}, "containers": {"cna": {"title": "Wazuh's vulnerability in host_deny AR script allows arbitrary command execution", "problemTypes": [{"descriptions": [{"cweId": "CWE-94", "lang": "en", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')", "type": "CWE"}]}], "metrics": [{"cvssV3_1": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}}], "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw"}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"version": ">= 4.2.0, < 4.7.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-19T14:28:20.318Z"}, "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2."}], "source": {"advisory": "GHSA-mjq2-xf8g-68vw", "discovery": "UNKNOWN"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-50260", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T19:12:01.001698Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wazuh:wazuh:-:*:*:*:*:*:*:*"], "vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-06-04T17:17:44.360Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.332Z"}, "title": "CVE Program Container", "references": [{"name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw"}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "tags": ["x_refsource_CONFIRM", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T22:16:46.332Z"}}, {"metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2023-50260", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-04-22T19:12:01.001698Z"}}}], "affected": [{"cpes": ["cpe:2.3:a:wazuh:wazuh:-:*:*:*:*:*:*:*"], "vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": "-"}], "defaultStatus": "unknown"}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-04-22T19:09:04.966Z"}, "title": "CISA ADP Vulnrichment"}], "cna": {"title": "Wazuh's vulnerability in host_deny AR script allows arbitrary command execution", "source": {"advisory": "GHSA-mjq2-xf8g-68vw", "discovery": "UNKNOWN"}, "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "HIGH"}}], "affected": [{"vendor": "wazuh", "product": "wazuh", "versions": [{"status": "affected", "version": ">= 4.2.0, < 4.7.2"}]}], "references": [{"url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "name": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw", "tags": ["x_refsource_CONFIRM"]}], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-94", "description": "CWE-94: Improper Control of Generation of Code ('Code Injection')"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2024-04-19T14:28:20.318Z"}}}, "cveMetadata": {"cveId": "CVE-2023-50260", "state": "PUBLISHED", "dateUpdated": "2024-08-02T22:16:46.332Z", "dateReserved": "2023-12-05T20:42:59.379Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2024-04-19T14:28:20.318Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.1"}

{"cveTags": [], "descriptions": [{"lang": "en", "value": "Wazuh is a free and open source platform used for threat prevention, detection, and response. A wrong validation in the `host_deny` script allows to write any string in the `hosts.deny` file, which can end in an arbitrary command execution on the target system. This vulnerability is part of the active response feature, which can automatically triggers actions in response to alerts. By default, active responses are limited to a set of pre defined executables. This is enforced by only allowing executables stored under `/var/ossec/active-response/bin` to be run as an active response. However, the `/var/ossec/active-response/bin/host_deny` can be exploited. `host_deny` is used to add IP address to the `/etc/hosts.deny` file to block incoming connections on a service level by using TCP wrappers. Attacker can inject arbitrary command into the `/etc/hosts.deny` file and execute arbitrary command by using the spawn directive. The active response can be triggered by writing events either to the local `execd` queue on server or to the `ar` queue which forwards the events to agents. So, it can leads to LPE on server as root and RCE on agent as root. This vulnerability is fixed in 4.7.2."}, {"lang": "es", "value": "Wazuh es una plataforma gratuita y de c\u00f3digo abierto que se utiliza para la prevenci\u00f3n, detecci\u00f3n y respuesta a amenazas. Una validaci\u00f3n incorrecta en el script `host_deny` permite escribir cualquier cadena en el archivo `hosts.deny`, lo que puede terminar en la ejecuci\u00f3n de un comando arbitrario en el sistema de destino. Esta vulnerabilidad es parte de la funci\u00f3n de respuesta activa, que puede desencadenar acciones autom\u00e1ticamente en respuesta a alertas. De forma predeterminada, las respuestas activas est\u00e1n limitadas a un conjunto de ejecutables predefinidos. Esto se aplica permitiendo que solo los ejecutables almacenados en `/var/ossec/active-response/bin` se ejecuten como una respuesta activa. Sin embargo, el `/var/ossec/active-response/bin/host_deny` puede ser explotado. `host_deny` se usa para agregar una direcci\u00f3n IP al archivo `/etc/hosts.deny` para bloquear conexiones entrantes en un nivel de servicio mediante el uso de contenedores TCP. El atacante puede inyectar un comando arbitrario en el archivo `/etc/hosts.deny` y ejecutar un comando arbitrario utilizando la directiva spawn. La respuesta activa se puede activar escribiendo eventos en la cola \"execd\" local en el servidor o en la cola \"ar\" que reenv\u00eda los eventos a los agentes. Por lo tanto, puede conducir a LPE en el servidor como ra\u00edz y a RCE en el agente como ra\u00edz. Esta vulnerabilidad se soluciona en 4.7.2."}], "id": "CVE-2023-50260", "lastModified": "2024-04-19T16:19:49.043", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "security-advisories@github.com", "type": "Secondary"}]}, "published": "2024-04-19T15:15:50.040", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/wazuh/wazuh/security/advisories/GHSA-mjq2-xf8g-68vw"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-94"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}