Möglichkeit, die Agentenliste ohne Berechtigungszugriff in wazuh-dashboard in github.com/wazuh/wazuh anzuzeigen

The primary impact of CVE-2024-47770 is the unauthorized disclosure of Wazuh agent information. An attacker could leverage this information to identify potential targets for further attacks, map the network topology, and understand the security posture of the environment. While direct exploitation beyond viewing the agent list is not immediately apparent, this information could be used in conjunction with other vulnerabilities or reconnaissance efforts to escalate an attack. The blast radius is limited to the Wazuh Dashboard environment and the information it exposes about agents.

Organizations utilizing Wazuh Dashboard for security monitoring are at risk. Specifically, deployments with misconfigured access controls or those relying on default Wazuh Dashboard settings are particularly vulnerable. Shared hosting environments where Wazuh Dashboard is deployed alongside other applications should also be considered at higher risk.

• linux / server: Monitor Wazuh Dashboard logs for unauthorized access attempts to the agent list endpoint. Use journalctl -u wazuh-dashboard to filter for suspicious activity.

journalctl -u wazuh-dashboard | grep "agent_list" | grep "unauthorized"

• generic web: Use curl to test access to the agent list endpoint without authentication. A successful response indicates the vulnerability is present.

curl -I http://<wazuh_dashboard_ip>/agent_list

• go: Review Wazuh Dashboard source code for the agent list functionality to identify potential vulnerabilities. Look for areas where authentication checks are missing or inadequate.

1. 2025-02-04Disclosure

   disclosure

1. Reserviert2024-09-30
2. Veröffentlicht2025-02-04
3. Geändert2026-03-03
4. EPSS aktualisiert2026-04-02

The recommended mitigation for CVE-2024-47770 is to immediately upgrade Wazuh Dashboard to version 4.9.1+incompatible or later. If upgrading is not immediately feasible, consider implementing access controls and authentication restrictions within the Wazuh Dashboard to limit access to the agent list. Review Wazuh Dashboard configuration to ensure only authorized users have access. After upgrading, confirm the fix by verifying that unauthenticated users can no longer access the agent list through a web browser.