A path traversal vulnerability in the Wazuh ip-customblock script allows authenticated attackers to perform unauthorized file operations, potentially leading to full system compromise.

The vulnerability exists due to a lack of input validation in the ip-customblock script when processing the srcip field. An attacker with low privileges can inject path traversal sequences to escape the intended directory and manipulate files as the root user.

Successful exploitation allows an attacker to delete critical system files or create arbitrary files, which can be leveraged to compromise system integrity or cause a denial of service. Given the CVSS score of 8.1, this is a high-severity risk that could lead to complete loss of control over the affected Wazuh node if an attacker can manipulate sensitive configuration or credential files.

Immediate Action: Upgrade to Wazuh version 4.14.7 or later to implement the necessary input validation checks within the active response scripts.

Proactive Monitoring: Inspect system logs for unusual alert-matching events that contain non-IP characters or path traversal sequences, such as "../" patterns, within the srcip field.

Compensating Controls: If immediate patching is not feasible, consider disabling the ip-customblock active response script until the update can be applied to prevent potential exploitation.

Public Exploit Available: Unknown

The ability for a low-privileged user to execute arbitrary file operations as root represents a severe security failure. Organizations should prioritize updating their Wazuh deployments to version 4.14.7 immediately to eliminate this attack vector. Failure to patch leaves the underlying infrastructure susceptible to malicious file deletion or configuration tampering.