Wazuh up to 4.8.x on Windows rsync.dll access control

Summaryinfo

A vulnerability has been found in Wazuh up to 4.8.x on Windows and classified as critical. Affected is an unknown function in the library rsync.dll. This manipulation causes access control. This vulnerability is registered as CVE-2024-35177. The attack needs to be launched locally. No exploit is available. The affected component should be upgraded.

Detailsinfo

A vulnerability classified as critical was found in Wazuh up to 4.8.x on Windows. Affected by this vulnerability is an unknown part in the library rsync.dll. The manipulation with an unknown input leads to a access control vulnerability. The CWE definition for the vulnerability is CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. As an impact it is known to affect confidentiality, integrity, and availability. The summary by CVE is:

Wazuh is a free and open source platform used for threat prevention, detection, and response. It is capable of protecting workloads across on-premises, virtualized, containerized, and cloud-based environments. The wazuh-agent for Windows is vulnerable to a Local Privilege Escalation vulnerability due to improper ACL of the non-default installation directory. A local malicious user could potentially exploit this vulnerability by placing one of the many DLL that are loaded and not present on the system in the installation folder of the agent OR by replacing the service executable binary itself with a malicious one. The root cause is an improper ACL applied on the installation folder when a non-default installation path is specified (e.g,: C:\wazuh). Many DLLs are loaded from the installation folder and by creating a malicious DLLs that exports the functions of a legit one (and that is not found on the system where the agent is installed, such as rsync.dll) it is possible to escalate privileges from a low-privileged user and obtain code execution under the context of NT AUTHORITY\SYSTEM. This issue has been addressed in version 4.9.0 and all users are advised to upgrade. There are no known workarounds for this vulnerability.

It is possible to read the advisory at github.com. This vulnerability is known as CVE-2024-35177 since 05/10/2024. The exploitation appears to be easy. Attacking locally is a requirement. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 216199 (SUSE SLES15 / openSUSE 15 Security Update : govulncheck-vulndb (SUSE-SU-2025:0429-1)), which helps to determine the existence of the flaw in a target environment.

Upgrading to version 4.9.0 eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (216199). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Name

• Wazuh

Version

• 4.0
• 4.1
• 4.2
• 4.3
• 4.4
• 4.5
• 4.6
• 4.7
• 4.8

Website

• Product: https://github.com/wazuh/wazuh/

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion