SecBoard
Zurück zur CVE-Übersicht

CVE-2026-112337

LOW(3.7)

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N

Risk Signal Score14/100 — NIEDRIG

Erwähnungen (letzte 60 Tage)

Artikel

EPSS-Score

0.2%

Exploit-Wahrscheinlichkeit (30 Tage)

CVSS Score

3.7

Technische Schwere

Beschreibung

Wazuh from 3.7.0 before 4.14.9 contains a server-side request forgery vulnerability in the Azure wodle get_graph_events() function that follows @odata.nextLink without host or HTTPS validation. Attackers who influence the nextLink value can redirect manager requests to attacker-controlled endpoints, capturing the reused Microsoft Graph bearer token and reaching internal services.

Erkennung & Indikatoren

Ausnutzung

In den geprüften Quellen nicht genannt

Behobene Versionen

  • 4.14.9

Threat-Hunting-Queries

Detect attempts by the Wazuh manager to connect to non-Microsoft Graph endpoints when processing Azure Graph events, indicating a potential SSRF via @odata.nextLink manipulation. This requires monitoring outbound network connections from the Wazuh manager and correlating them with Azure Graph wodle activity.

Sentinel/Defender KQL

DeviceNetworkEvents
| where InitiatingProcessFileName contains "wazuh-manager" or InitiatingProcessCommandLine contains "wodles/azure/azure_services/graph.py"
| where RemoteUrl !startswith "https://graph.microsoft.com" and RemoteUrl !startswith "https://graph.windows.net"
| project TimeGenerated, DeviceName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemotePort, RemoteUrl, ActionType

Splunk SPL

(sourcetype="wazuh:manager" OR sourcetype="wazuh:alerts") (process="wazuh-manager" OR process="python" path="*wodles/azure/azure_services/graph.py*")
| search NOT (dest_url LIKE "https://graph.microsoft.com%" OR dest_url LIKE "https://graph.windows.net%")
| table _time, host, process, command, dest_ip, dest_port, dest_url

Sigma

title: Wazuh Azure Graph SSRF Attempt
status: experimental
description: Detects suspicious outbound connections from Wazuh manager that are not directed to legitimate Microsoft Graph endpoints, potentially indicating an SSRF vulnerability exploitation via @odata.nextLink.
logsource:
  category: network_connection
  product: linux
detection:
  selection:
    ParentImage|endswith: 'wazuh-manager'
    Image|endswith: 'python'
    CommandLine|contains: 'wodles/azure/azure_services/graph.py'
    Initiated: 'true'
  filter_microsoft_graph:
    DestinationUrl|startswith:
      - 'https://graph.microsoft.com'
      - 'https://graph.windows.net'
  condition: selection and not filter_microsoft_graph
fields:
  - CommandLine
  - DestinationIp
  - DestinationPort
  - DestinationUrl
level: medium

Elastic ES|QL

from network.connection
| where process.parent.executable.name == "wazuh-manager" or process.executable.name == "python" and process.args contains "wodles/azure/azure_services/graph.py"
| where not (destination.url.full starts_with "https://graph.microsoft.com" or destination.url.full starts_with "https://graph.windows.net")
| select @timestamp, host.name, process.parent.executable.name, process.executable.name, process.command_line, destination.ip, destination.port, destination.url.full

SecBoard-generated · behavioral · requires customization — Von SecBoard erzeugt und nicht in einer Zielumgebung validiert. Vor dem Einsatz an die eigene Protokollierung anpassen.

Referenzen