Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)

#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##

include('compat.inc');

if (description)
{
  script_id(339363);
  script_version("1.1");
  script_set_attribute(attribute:"plugin_modification_date", value:"2026/08/25");

  script_cve_id("CVE-2026-44256");

  script_name(english:"Wazuh Server 4.4.0 < 4.14.6 Log Injection (CVE-2026-44256)");

  script_set_attribute(attribute:"synopsis", value:
"The remote host contains a threat prevention, detection, and response platform that is affected by a log injection vulnerability.");
  script_set_attribute(attribute:"description", value:
"The version of Wazuh Server on the remote host is at least 4.4.0 and prior to 4.14.6. It is, therefore, affected by a
log injection vulnerability:

  - The Basic authentication username is decoded before credential validation and passed to the access logger without
    neutralizing control characters. An unauthenticated attacker can include carriage returns or line feeds in the
    username to forge log entries or obscure activity in the plain-text audit log. (CVE-2026-44256)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version
number.");
  # https://github.com/wazuh/wazuh/security/advisories/GHSA-c3m6-fp2h-wmr4
  script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?54ba39df");
  script_set_attribute(attribute:"solution", value:
"Upgrade to Wazuh Server version 4.14.6 or later.");
  script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:N/I:P/A:N");
  script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N");
  script_set_attribute(attribute:"cvss_score_source", value:"CVE-2026-44256");

  script_cwe_id(117);

  script_set_attribute(attribute:"vuln_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"patch_publication_date", value:"2026/08/07");
  script_set_attribute(attribute:"plugin_publication_date", value:"2026/08/25");

  script_set_attribute(attribute:"plugin_type", value:"local");
  script_set_attribute(attribute:"cpe", value:"cpe:/a:wazuh:wazuh");
  script_set_attribute(attribute:"agent", value:"unix");
  script_set_attribute(attribute:"thorough_tests", value:"true");
  script_end_attributes();

  script_category(ACT_GATHER_INFO);
  script_family(english:"Misc.");

  script_copyright(english:"This script is Copyright (C) 2026 and is owned by Tenable, Inc. or an Affiliate thereof.");

  script_dependencies("wazuh_server_nix_installed.nbin");
  script_require_keys("installed_sw/Wazuh-Manager");

  exit(0);
}

include('vdf.inc');

# @tvdl-content
var vuln_data = {
  'metadata': {'spec_version': '1.0'},
  'checks': [
    {
      'product': {'name': 'Wazuh-Manager', 'type': 'app'},
      'check_algorithm': 'default',
      'constraints': [
        {'min_version': '4.4.0', 'fixed_version': '4.14.6'}
      ]
    }
  ]
};

var result = vdf::check_and_report(vuln_data:vuln_data, severity:SECURITY_WARNING);
vdf::handle_check_and_report_errors(vdf_result:result);