CVE-2026-54083

Executive Summary

CVE-2026-54083 is a path traversal vulnerability (CWE-22) in the ip-customblock active response script of Wazuh, an open-source XDR/SIEM platform. An authenticated attacker able to inject crafted log events with a malicious srcip field can create or delete arbitrary files on the Wazuh server as root, leading to full system compromise. The vulnerability is unpatched in production as of this writing (fix scheduled for version 4.14.7), and carries a CVSS base score of 8.1 (High) due to its high integrity and availability impact.

Technical Analysis

Vulnerability Mechanism

The ip-customblock active response script is part of Wazuh's response framework, designed to block malicious source IP addresses by appending them to a blocklist file. The vulnerability stems from improper input validation in the path construction logic:

1. Unsanitized input: The script extracts the srcip field from alert JSON data and concatenates it directly onto the fixed /ipblock/ base directory path.
2. Missing validation: Unlike sibling scripts (host-deny.c, default-firewall-drop.c, firewalld-drop.c) which call get_ip_version() to reject non-IP input, ip-customblock.c omits this check entirely.
3. Path traversal: An attacker who can trigger alert-matching log events with a crafted srcip value containing ../ sequences can escape the base directory.

Attack Surface

• Vector: Network (AV:N)
• Complexity: Low (AC:L) — no special conditions required beyond the ability to deliver crafted log events
• Privileges Required: Low (PR:L) — attacker needs some authenticated access or ability to influence log content
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)

Two Exploitable Actions

Block Action (File Creation)

The block action opens the constructed path in append mode, creating an empty file at an arbitrary location. This enables attackers to:

• Create new files anywhere on the filesystem
• Potentially interfere with service startup scripts, cron jobs, or other filesystem-based workflows

Unblock Action (File Deletion)

The unblock action passes the constructed path to remove(), deleting an arbitrary file. This is significantly more dangerous as it allows:

• Deletion of system credentials (e.g., /etc/shadow, /etc/passwd)
• Deletion of Wazuh configuration files (ossec.conf, manager configuration)
• Deletion of critical system files (kernel modules, init scripts, shared libraries)
• Denial-of-service against the host or the Wazuh platform itself

Root Privilege Escalation

The active response daemon runs with root privileges, meaning both file creation and deletion occur with full system-level permissions. This elevates the impact from a mere filesystem integrity issue to a full system compromise primitive.

Vulnerability Class Context

This is a classic absolute/relative path traversal (CWE-22) failure where:

• The application builds filesystem paths using attacker-controlled data
• No normalization or containment check is performed
• The ../ sequence allows traversal outside the intended directory

The root cause is the absence of the get_ip_version() validation that sibling scripts employ, creating an inconsistency in the codebase's security posture.

Exploitation Scenarios

Prerequisites

• Attacker must be able to deliver log events to Wazuh that trigger the active response rule associated with ip-customblock
• Attacker needs authenticated access to a system monitored by Wazuh, or the ability to spoof/inject syslog or agent events
• The Wazuh manager must have ip-customblock configured as the active response action for the relevant rule

Note: No public PoC is available; the attack chain is inferred from the vulnerability class and affected functionality.

Step 1: Reconnaissance / Target Identification

• Attacker identifies Wazuh installations (version < 4.14.7) via network scanning, Shodan, or banner grabbing
• Attacker determines whether ip-customblock is among the configured active responses by observing system behavior or probing response triggers

Step 2: Crafting the Malicious Event

• Attacker crafts a log event that matches a Wazuh rule triggering the ip-customblock active response
• The srcip field is set to a value such as ../../../../etc/cron.d/evil (for file creation) or ../../../../etc/shadow (for deletion)
• The ../ sequences traverse out of the /ipblock/ base directory

Step 3: Delivery and Execution

• Attacker sends the crafted log event through an agent or directly to the Wazuh manager
• Upon rule match, the active response daemon invokes ip-customblock
• File creation (block action): The script opens /ipblock/../../../../etc/cron.d/evil in append mode — creating an empty file at /etc/cron.d/evil
• File deletion (unblock action): The script calls remove() on the traversed path — deleting arbitrary files
• Both operations execute as root

Step 4: Post-Exploitation

• Simple denial of service: Delete /etc/passwd, /etc/shadow, or system binaries
• Potential privilege escalation: Create cron jobs (e.g., /etc/cron.d/backdoor), add entries to /etc/ld.so.preload, plant files in startup directories
• Platform disablement: Delete Wazuh configuration files to blind the SIEM platform and prevent detection of further attacks

Feasibility Assessment

• Exploitation difficulty: Low — no exotic prerequisites; standard log injection or agent compromise
• Reliability: High for file deletion; file creation requires subsequent content injection which this flaw alone does not enable (files are created empty)
• Attacker sophistication required: Moderate — understanding of Wazuh rule triggers and active response configuration is needed

Impact Assessment

Business Impact

Affected Systems

• All Wazuh manager installations running versions prior to 4.14.7
• Deployments using the ip-customblock active response script (default in many configurations)
• Systems where the Wazuh manager operates with root privileges (standard deployment)

Blast Radius

• Direct: The Wazuh server host itself (filesystem compromise as root)
• Indirect: All monitored endpoints — a compromised SIEM/EDR platform can blind defenders, allowing undetected attacks across the entire monitored estate
• Secondary: Any system relying on the integrity of the Wazuh manager's configurations or the alerts it generates

CVSS Rationale

The 8.1 score reflects:

• Network vector with low complexity enables remote exploitation
• Low privilege requirement — the attacker need not have prior access to the Wazuh server itself
• High impact on integrity and availability without confidentiality impact
• Unchanged scope limits propagation beyond the vulnerable component

Detection Guidance

Sigma Rule

title: Wazuh ip-customblock Path Traversal Attempt
id: 9a3f7d2e-5b8c-4e1a-9f6d-2c4e8a1b3f5d
status: experimental
description: Detects crafted srcip values containing path traversal sequences in Wazuh alert events that could exploit CVE-2026-54083 in ip-customblock active response
author: Valtersit Threat Intelligence
date: 2026/01/01
logsource:
    product: wazuh
    category: alerts
detection:
    selection:
        srcip|contains:
            - '..%2f'
            - '..%5c'
            - '..\\'
            - '../'
    condition: selection
falsepositives:
    - Legitimate log sources with unusual srcip formatting
level: high
tags:
    - attack.t1190
    - cve.2026-54083
    - cwe.22

YARA Rule

rule Wazuh_ip_customblock_PathTraversal
{
    meta:
        author = "Valtersit Threat Intelligence"
        description = "Detects path traversal payloads targeting Wazuh ip-customblock active response"
        cve = "CVE-2026-54083"
        reference = "NVD CVE-2026-54083"
        date = "2026-01-01"
        score = 80
    strings:
        $trav1 = "../"
        $trav2 = "..\\"
        $trav3 = "..%2f"
        $trav4 = "..%2e%2e"
        $srcip_field = "srcip"
        $ipblock_path = "/ipblock/"
        $cron_path = "/etc/cron"
        $shadow_path = "/etc/shadow"
        $passwd_path = "/etc/passwd"
        $wazuh_config = "ossec.conf"
    condition:
        $srcip_field and
        any of ($trav*) and
        (any of ($cron_path, $shadow_path, $passwd_path, $wazuh_config) or
         filesize < 10KB)
}

Suricata IDS Rule

alert http any any -> any any (msg:"ET EXPLOIT Wazuh ip-customblock Path Traversal Attempt (CVE-2026-54083)"; flow:established,to_server; content:"srcip"; http_client_body; content:"../"; distance:0; http_client_body; content:"/ipblock/"; distance:0; http_client_body; content:!"./"; http_client_body; pcre:"/srcip[\"']?\s*[:=]\s*[\"']?[^\"']*\.\.\//i"; classtype:attempted-admin; sid:2026054083; rev:1; metadata:created_at 2026_01_01, updated_at 2026_01_01, cve CVE_2026_54083;)

Note: This rule targets network-based delivery of crafted events. Adapt to your log ingestion transport (syslog, agent protocol, REST API) as needed.

Elastic Detection

sequence by agent.id with maxspan=1m
  [any where event.dataset == "wazuh.alerts" and
   source.ip != null and
   (source.ip contains "../" or 
    source.ip contains "..\\" or 
    source.ip contains "..%2f")]

Splunk SPL Query

index=wazuh sourcetype="wazuh:alerts"
| where match(srcip, "\.\./|\.\.\\\\|\.\.%2f")
| table _time, agent.name, rule.id, srcip, manager.name
| stats count by srcip, agent.name, rule.id
| sort - count

Wazuh OSSEC Rule

<group name="path_traversal,">
  <rule id="356057" level="12">
    <if_sid>54083</if_sid>
    <field name="srcip" type="pcre2">\.\.(/|\\|%2f)</field>
    <description>Wazuh ip-customblock path traversal attempt detected (CVE-2026-54083)</description>
    <group>attack.t1190,cve.2026-54083,cwe.22,</group>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED

No patch evidence from any tracked source was identified. The NVD description indicates a fix is scheduled for version 4.14.7, but no official advisory or patch artifacts are currently available.

1) Immediate Mitigations

• Disable ip-customblock active response: If not actively used, remove or disable this script from your active response configuration
• Restrict rule triggers: Review Wazuh rules that invoke ip-customblock and ensure only trusted, validated log sources can trigger them
• Harden log ingestion: Validate/normalize srcip fields at the collection layer (Logstash, Syslog, Wazuh API) — reject events with non-IP values in the source IP field
• Network segmentation: Restrict access to the Wazuh manager's ingestion ports to monitored agents only; block external log injection
• Filesystem protections: Implement file integrity monitoring (FIM) on sensitive files (/etc/passwd, /etc/shadow, Wazuh configuration) to alert on unauthorized modifications or deletions

2) Patch / Upgrade Steps

• Monitor for version 4.14.7: Track Wazuh release announcements and security advisories
• Plan upgrade path: When 4.14.7 is released, schedule an immediate upgrade of all Wazuh manager instances
• Validate the fix: After upgrade, verify that ip-customblock.c now calls get_ip_version() or an equivalent validation routine
• Test active responses: Confirm the patched script rejects non-IP input before re-enabling

3) Long-Term Hardening

• Principle of least privilege: Consider running the active response daemon with reduced privileges (non-root) where architecture permits
• Input validation standard: Adopt a policy requiring all active response scripts to validate their inputs using established utility functions
• Regular security review: Audit custom and default active response scripts for similar path construction vulnerabilities
• Monitor vendor advisories: Subscribe to Wazuh's security advisory distribution to stay informed of related fixes
• Defense in depth: Deploy endpoint detection beyond the SIEM; do not rely solely on Wazuh for security monitoring in case the platform is compromised

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-54083
2. Wazuh Official Site: https://wazuh.com/ — monitor for official security advisory and version 4.14.7 release notes
3. Wazuh GitHub Repository: https://github.com/wazuh/wazuh — track source code changes in ip-customblock.c
4. CWE-22 Reference: https://cwe.mitre.org/data/definitions/22.html — Improper Limitation of a Pathname to a Restricted Directory
5. MITRE ATT&CK T1190: https://attack.mitre.org/techniques/T1190/ — Exploit Public-Facing Application

Threat Actor Activity: No known threat actor campaigns targeting this CVE have been identified as of this writing. No CISA KEV listing exists, and no exploit code is publicly available. The vulnerability's severity is elevated by its root-level file system access, making it an attractive target for APT groups and ransomware operators once weaponized tools become available.