Week of April 15, 2024

Neodyme researchers discovered two critical vulnerabilities in the Wazuh security platform: CVE-2024-32038, a heap buffer overflow in the Windows event decoder allowing unauthenticated remote code execution on the Wazuh server, and CVE-2023-50260, a command injection enabling privilege escalation and lateral movement. These flaws can be chained to achieve full network compromise from initial access, turning the defensive tool into an attack vector.

SafeBreach researchers presented a proof-of-concept technique that bypasses protection modules in the Cortex XDR agent on Windows. The bypass requires administrative privileges and is detected and blocked by content update CU-1320 or later. Palo Alto Networks states this is not a product vulnerability and no malicious exploitation has been observed.

A security researcher demonstrated a proof-of-concept attack turning Palo Alto Networks Cortex XDR into malware by bypassing its anti-tampering mechanism and modifying plaintext Lua rule files. This allowed loading a vulnerable driver, disabling protections, and deploying a reverse shell and ransomware. Palo Alto has fixed all but one of the associated weaknesses.