CVE-2021-44079
📋 TL;DR
CVE-2021-44079 is a command injection vulnerability in Wazuh's wazuh-slack active response script that allows remote code execution by passing untrusted user agents to curl commands. This affects Wazuh 4.2.x installations before version 4.2.5. Attackers can execute arbitrary commands with the privileges of the Wazuh process.
💻 Affected Systems
- Wazuh
📦 What is this software?
Wazuh by Wazuh
⚠️ Risk & Real-World Impact
Worst Case
Full system compromise with root-level code execution, data exfiltration, and lateral movement across the network.
Likely Case
Remote code execution leading to malware deployment, credential theft, and persistence establishment.
If Mitigated
Limited impact with proper network segmentation and least privilege configurations.
🎯 Exploit Status
Exploitation requires access to trigger active responses, typically via authenticated alerts.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 4.2.5
Vendor Advisory: https://github.com/wazuh/wazuh/issues/10858
Restart Required: Yes
Instructions:
1. Backup current configuration. 2. Update Wazuh to version 4.2.5 or later. 3. Restart Wazuh services. 4. Verify active response functionality.
🔧 Temporary Workarounds
Disable Slack Active Response
linuxTemporarily disable the vulnerable wazuh-slack active response script
mv /var/ossec/active-response/bin/wazuh-slack /var/ossec/active-response/bin/wazuh-slack.disabled
systemctl restart wazuh-manager
Restrict Active Response Triggers
allModify active-response configuration to limit which alerts trigger Slack responses
Edit /var/ossec/etc/ossec.conf and restrict <active-response> rules for Slack
🧯 If You Can't Patch
- Disable all active response features in Wazuh configuration
- Implement strict network segmentation to isolate Wazuh management interface
🔍 How to Verify
Check if Vulnerable:
Check Wazuh version: if version starts with '4.2.' and is less than '4.2.5', system is vulnerableCheck Version:
/var/ossec/bin/wazuh-control info | grep 'WAZUH_VERSION'Verify Fix Applied:
Verify version is 4.2.5 or higher and test active response functionality📡 Detection & Monitoring
Log Indicators:
- Unusual curl commands in active response logs
- Suspicious process execution from wazuh-slack script
Network Indicators:
- Unexpected outbound connections from Wazuh server
- Slack API calls with unusual user-agent strings
SIEM Query:
source="wazuh" AND "active-response" AND "wazuh-slack" AND (curl OR command)🔗 References
- https://github.com/wazuh/wazuh/issues/10858
- https://github.com/wazuh/wazuh/issues/10858#issuecomment-991118254
- https://github.com/wazuh/wazuh/pull/10809
- https://github.com/wazuh/wazuh/issues/10858
- https://github.com/wazuh/wazuh/issues/10858#issuecomment-991118254
- https://github.com/wazuh/wazuh/pull/10809
