A critical shell injection vulnerability in Wazuh workflows allows unauthenticated attackers to achieve command execution on self-hosted runners via malicious pull requests.

The vulnerability exists due to improper neutralization of shell metacharacters in GitHub Actions workflow inputs. An attacker can inject malicious commands that execute during the workflow process, leading to potential secret exfiltration, including GITHUB_TOKEN and AWS credentials.

Successful exploitation of this vulnerability permits unauthorized command execution on build infrastructure. This could lead to a total compromise of the CI/CD pipeline, unauthorized access to sensitive cloud credentials, and the potential for lateral movement into the wider production environment. Given the CVSS score of 10.0, this represents an extreme risk to organizational integrity and data confidentiality.

Immediate Action: Update your Wazuh deployment to version 44bf114 or later immediately to incorporate the necessary security patches for workflow processing.

Proactive Monitoring: Review CI/CD logs for anomalous pull request activity, specifically monitoring for unusual file modifications in VERSION.json or unexpected processes spawning from GitHub Action runners.

Compensating Controls: Restrict permissions for self-hosted runners and ensure they operate in an isolated environment with minimal access to sensitive production secrets or credentials.

Public Exploit Available: No (Exploit available: unknown)

This vulnerability is classified as critical due to its potential for full remote command execution. Organizations utilizing Wazuh with self-hosted GitHub Actions runners must prioritize patching as the primary defense against potential supply chain attacks.