CVE-2025-15612: 
Wazuh Server vulnerability analysis and mitigation

CVE-2025-15612 is an insecure transport vulnerability in Wazuh provisioning scripts and Dockerfiles where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. This flaw enables attackers with network access to perform man-in-the-middle (MITM) attacks to intercept and modify downloaded dependencies or source code during the build process, potentially leading to remote code execution (RCE) and supply chain compromise. It affects Wazuh versions 4.1.3 through 4.13.x (fixed in 4.14.0) and was published on March 27, 2026, with the advisory originally authored December 4, 2025. The vulnerability carries a CVSS v3.1 base score of 8.1 (High) per NVD, though the GitHub advisory rates it Moderate (4.8) (GitHub Advisory).

The root cause is improper certificate validation (CWE-295) combined with inclusion of functionality from an untrusted control sphere (CWE-829). Multiple files in the Wazuh repository invoke curl with the -k or --insecure flag, including packages/debs/amd64/agent/Dockerfile, packages/aix/generate_wazuh_packages.sh, packages/hp-ux/generate_wazuh_packages.sh, and packages/rpms/i386/legacy/Dockerfile. These scripts fetch critical build dependencies and source code — such as Perl tarballs, GCC/CMake toolchains, CA certificate bundles, and the Wazuh source archive itself — over HTTPS without validating the server's TLS certificate. An attacker positioned on the build network (e.g., via ARP spoofing or a transparent proxy) can intercept these requests and serve malicious content, which the build system will consume without any validation warning (GitHub Advisory).

Successful exploitation allows an attacker to inject arbitrary code into the Wazuh build pipeline, resulting in full compromise of confidentiality, integrity, and availability of the built packages and the systems that install them. Because the attack targets the build process itself, all downstream users of packages produced from these scripts are potentially affected — not just the build host. The supply chain impact is particularly severe: malicious code injected into a CA certificate bundle or source archive could persist in distributed Wazuh agent packages, enabling persistent access across all deployments (GitHub Advisory).

1. Reconnaissance: Identify a Wazuh build environment running provisioning scripts or Dockerfiles from versions 4.1.3–4.13.x, particularly on networks where the attacker can intercept traffic.
2. Network Positioning: Gain a man-in-the-middle position on the build network using ARP spoofing (e.g., with arpspoof or ettercap) or by setting up a transparent proxy (e.g., mitmproxy).
3. Intercept HTTPS Requests: Capture outbound HTTPS requests from the build host to targeted URLs such as https://curl.se/ca/cacert.pem, http://www.cpan.org/src/5.0/perl-5.10.1.tar.gz, http://packages.wazuh.com/utils/gcc/gcc_9.4_HPUX_build.tar.gz, or https://github.com/wazuh/wazuh/archive/${wazuh_branch}.zip.
4. Serve Malicious Content: Respond to the intercepted request with a crafted malicious file (e.g., a backdoored CA bundle, a trojanized source tarball, or a modified build dependency). Because curl is invoked with -k, no certificate validation occurs and the build system accepts the response.
5. Achieve Code Execution: The malicious content is incorporated into the build process, resulting in arbitrary code execution on the build host or in the resulting packages distributed to downstream users (GitHub Advisory).

• Network: Unexpected ARP replies or gratuitous ARP packets on the build network segment; outbound HTTPS connections from the build host to known-good URLs being redirected to unexpected IP addresses; TLS certificate mismatches (if monitoring is in place despite -k usage).
• File System: Unexpected modification timestamps on downloaded files (e.g., cacert.pem, perl-5.10.1.tar.gz, wazuh.zip); checksum mismatches on build dependencies compared to known-good hashes; presence of unexpected binaries or scripts in the build output.
• Logs: Build logs showing successful downloads from URLs that resolve to unexpected IP addresses; anomalous process execution during the build (e.g., unexpected outbound connections spawned by build scripts); Docker build logs referencing modified layer content.
• Process: Unexpected child processes spawned during the build (e.g., reverse shells, curl/wget to attacker-controlled hosts); unusual network connections from the build container or host post-build (GitHub Advisory).

Upgrade Wazuh to version 4.14.0 or later, which removes the -k/--insecure flags from all curl invocations in provisioning scripts and Dockerfiles. As an interim workaround, restrict network access during the build process to trusted, controlled environments and isolate build networks from untrusted segments. Additionally, implement cryptographic verification (e.g., checksum validation) of all downloaded artifacts, use package managers with built-in integrity checks, and consider certificate pinning for critical downloads. Monitor for unexpected network connections during provisioning (GitHub Advisory).

The vulnerability was discovered by automated tooling from Socket and reported by researcher @JLLeitschuh, credited in the official Wazuh GitHub advisory. The advisory was published by Wazuh maintainer vikman90 and linked to remediation pull requests #32046 and #32047. No significant broader media coverage or notable community debate has been identified beyond the advisory itself (GitHub Advisory).