Add destination confinement to worker non-merged and extra file paths
fix(cluster): add destination confinement to worker non-merged and extra file paths
Add destination confinement to worker non-merged and extra file pathsf7f7c4-fix-add-destination-confinement-to-worker-non-merged-cve-2026-61800fixadd destination confinement worker non merged
Committed by jotacarma90
commit message
fix(cluster): add destination confinement to worker non-merged and extra file paths
The non-merged branch of update_master_files_in_worker() moved files to
safe_join(WAZUH_PATH, filename) without validating the destination against
the declared cluster_item_key directory. The extra branch had the same gap
before calling os.remove(). A compromised master or any holder of the cluster
key could place or delete arbitrary files under /var/ossec on every worker,
including locations executed as root (active-response, wodles, integrations).
Apply the same expected_base + os.path.commonpath confinement used by the
merged branch and by process_files_from_worker on the master side:
- Validate cluster_item_key exists in cluster_items['files'].
- Reject any path whose commonpath with expected_base diverges from it.
- Reject filenames present in the excluded_files list (non-merged only).
Refs: #5244Editor assessment
This commit patches CVE-2026-61800. The subject states the fix, destination confinement for worker non-merged and extra file paths, and the body then earns the score. It explains that both branches moved or removed files under WAZUH_PATH without checking the declared cluster_item_key directory, that a compromised master or cluster-key holder could write or delete arbitrary files including root-executed locations, and that the same expected_base plus commonpath check used elsewhere is now applied. The three-step remediation list and the rejected excluded_files case make the change auditable. The Refs footer to #5244 is well formed. Exemplary impact analysis.