Patchfirst
Patchfirst
CVE-2025-24016 KEVPublic exploit Critical · 9.9 EPSS 93.8%

Wazuh Server Deserialization of Untrusted Data Vulnerability

Wazuh · Wazuh Server

Summary

The vulnerability is an unsafe deserialization flaw in the Wazuh Server product, in its DistributedAPI handling, where parameters serialized as JSON are deserialized via as_wazuh_object in framework/wazuh/core/cluster/common.py. An attacker with API access (such as a compromised dashboard or a cluster server), or in some configurations a compromised agent, who can inject an unsanitized dictionary into a DAPI request or response can forge an unhandled exception to execute arbitrary Python code remotely on the Wazuh server, affecting versions from 4.4.0 up to but not including 4.9.1.

Official description · NVD

Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code execution on Wazuh servers. DistributedAPI parameters are a serialized as JSON and deserialized using `as_wazuh_object` (in `framework/wazuh/core/cluster/common.py`). If an attacker manages to inject an unsanitized dictionary in DAPI request/response, they can forge an unhandled exception (`__unhandled_exc__`) to evaluate arbitrary python code. The vulnerability can be triggered by anybody with API access (compromised dashboard or Wazuh servers in the cluster) or, in certain configurations, even by a compromised agent. Version 4.9.1 contains a fix.

Breakdown
69.9 / 100
Exploited
Yes, in CISA KEV
Reports
0
Tactics
5/15

How an attack unfolds

Based on mappings. Select a step to see the evidence.

  1. How attackers get in

  2. What they do

First seen exploited 3 months after disclosure. Public exploit code (Metasploit) was available the same day.

  1. DisclosedPublic exploit codeMetasploitday 0
  2. First seen exploitedVulnCheck KEV evidence+3 mo
  3. Added to CISA KEVEU database agrees+4 mo

CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.

3 fixes in github.com/wazuh/wazuh over 7 days. The latest fix listed for github.com/wazuh/wazuh is 4.9.1+incompatible.

Fixes in github.com/wazuh/wazuhGo package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

  1. 4.9.0+incompatibleCVE-2024-351773 Feb 2025
  2. 4.9.1+incompatibleCVE-2024-477703 Feb 2025
  3. 4.9.1+incompatibleCVE-2025-2401610 Feb 2025KEVLatest listed

techniques

2 , grouped by in kill-chain order 2

Initial AccessTA0001

Valid Accounts T1078 also Persistence, Privilege Escalation, Stealth
MITRE CTID mapping of the KEV entry · how it is exploited

Attackers with API access have been reported as exploiting this vulnerability through a JSON payload sent to a Wazuh worker server. Requests relayed to the master server can result in arbitrary code execution.

ExecutionTA0002

Command and Scripting Interpreter T1059
MITRE CTID mapping of the KEV entry · primary impact
Lower-confidence links (1)

These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.

  • Exploitation for Client ExecutionT1203 server-side bug exploitable without user interaction; client-execution technique does not fit

Detection

0 rules for this CVE · 151 general rules for its techniques

Rules for this CVE

0 that reference CVE-2025-24016 directly.

CVE-specific rules are not available in this build. Search SigmaHQ ↗

General rules for this CVE’s techniques

These detect the technique in general, not this specific vulnerability.

Valid AccountsT107856 general rules
All 56 on SigmaHQ ↗
Command and Scripting InterpreterT105995 general rules
All 95 on SigmaHQ ↗

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: github.com/wazuh/wazuh.

Gogithub.com/wazuh/wazuhGHSA-hcrc-79hj-m3qhGO-2025-3459

Upgrade to 4.9.1 or later

Gogo get github.com/wazuh/wazuh@v4.9.1

The first fix for CVE-2025-24016. No other CVE tracked by Patchfirst affects this package.

Affected versions, by release line

If you runUpgrade to
4.4.0 up to 4.9.14.9.1
4.4.0+incompatible up to 4.9.1+incompatible4.9.1+incompatible

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

Also mentioned in 50 community threat pulses (AlienVault OTX)

Weaker evidence

Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.

References

2 links, grouped by NVD tag

Vendor Advisory 1

github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh

US Government Resource 1

cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2025-24016
↑ ↓ chooseEnter openEsc close