CVE-2025-24016

DistributedAPI (DAPI) parameters are serialized as JSON and deserialized using the `as_wazuh_object` function in the file `framework/wazuh/core/cluster/common.py`. An attacker who manages to inject an unverified dictionary into a DAPI request or response can craft an unhandled exception (`__unhandled_exc__`), which during deserialization leads to arbitrary Python code execution. The vulnerability can be triggered by anyone with API access (e.g., via a compromised dashboard or another Wazuh server in the cluster), and in some configurations also by a compromised agent.

An attacker can remotely execute arbitrary code on the Wazuh server with process privileges, which in practice means full control over the server, potential breach of data confidentiality, system integrity, and availability.

Wazuh must be urgently updated to version 4.9.1, which contains a patch eliminating the vulnerability. According to manufacturer references: https://github.com/wazuh/wazuh/security/advisories/GHSA-hcrc-79hj-m3qh

Wazuh versions 4.4.0 to 4.9.0 (prior to version 4.9.1)

Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Wazuh contains a deserialization of untrusted data vulnerability that allows for remote code execution on Wazuh servers.