CVE-2025-34294
Severity CVSS v4.0:
HIGH
Type:
Unavailable / Other
Publication date:
28/10/2025
Last modified:
30/10/2025
Description
Wazuh's File Integrity Monitoring (FIM), when configured with automatic threat removal, contains a time-of-check/time-of-use (TOCTOU) race condition that can allow a local, low-privileged attacker to cause the Wazuh service (running as NT AUTHORITY\SYSTEM) to delete attacker-controlled files or paths. The root cause is insufficient synchronization and lack of robust final-path validation in the threat-removal workflow: the agent records an active-response action and proceeds to perform deletion without guaranteeing the deletion target is the originally intended file. This can result in SYSTEM-level arbitrary file or folder deletion and consequent local privilege escalation. Wazuh made an attempted fix via pull request 8697 on 2025-07-10, but that change was incomplete.
Impact
Base Score 4.0
7.10
Severity 4.0
HIGH
References to Advisories, Solutions, and Tools
- https://documentation.wazuh.com/current/user-manual/capabilities/active-response/index.html
- https://github.com/wazuh/wazuh-documentation/pull/8697
- https://wazuh.com/blog/detecting-and-responding-to-malicious-files-using-cdb-lists-and-active-response/
- https://www.vulncheck.com/advisories/wazuh-file-integrity-monitoring-and-active-response-arbitrary-file-deletion-as-system