FROM GUARDIAN TO GATEWAY: THE HIDDEN RISK OF EDR VULNERABILITIES

Summary from the TLDR InfoSec newsletter

The author decided to examine the Wazuh EDR tool via fuzzing and found 2 vulnerabilities that could lead to total network compromise. Wazuh consists of an agent that runs on the device, a server that accepts events from the agent, and an analysis engine that parses the event to trigger actions. The author describes how they discovered a command injection vulnerability in the host_deny active response which they chained with a heap buffer overflow that allowed for RCE to achieve unauthenticated RCE as root to compromise a full network.