Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-26814

CVE-2021-26814: Improper Input Validation (RCE)

8.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-26814
GHSA ID
GHSA-w36g-q975-37rg
EPSS Score
0.98309%
CWE
CWE-20
Published
3/18/2021
Updated
2/1/2023
KEV Status
No
Technology
TechnologyJavaScript

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Package NameEcosystemVulnerable VersionsFirst Patched Version
wazuhnpm>= 4.0.0, <= 4.0.34.0.4

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from incomplete input validation in API endpoints handling file operations. Based on the CVE description and release notes:

  1. The /manager/files endpoint was explicitly called out as vulnerable
  2. The patch added input validation checks for file operations
  3. The RCE vector implies direct file handling functions would appear in stack traces during exploitation
  4. The cluster file endpoint was also mentioned as affected in release notes While exact function names aren't visible in provided patches, Wazuh's architecture patterns and endpoint mapping strongly suggest controller-level file handling functions would be involved in processing these requests.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

W*zu* *PI in W*zu* *rom *.*.* to *.*.* *llows *ut**nti**t** us*rs to *x**ut* *r*itr*ry *o** wit* **ministr*tiv* privil***s vi* /m*n***r/*il*s URI. *n *ut**nti**t** us*r to t** s*rvi** m*y *xploit in*ompl*t* input v*li**tion on t** /m*n***r/*il*s *PI

Reasoning

T** vuln*r**ility st*ms *rom in*ompl*t* input v*li**tion in *PI *n*points **n*lin* *il* op*r*tions. **s** on t** *V* **s*ription *n* r*l**s* not*s: *. T** /m*n***r/*il*s *n*point w*s *xpli*itly **ll** out *s vuln*r**l* *. T** p*t** ***** input v*li**