CVE-2025-15612: Wazuh Insecure Transport RCE Vulnerability

CVE-2025-15612 Overview

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

Critical Impact

This vulnerability enables attackers to intercept and tamper with downloads during Wazuh build processes, potentially injecting malicious code into the supply chain and achieving remote code execution on systems running compromised builds.

Affected Products

• Wazuh provisioning scripts
• Wazuh Dockerfiles
• Wazuh build infrastructure components

Discovery Timeline

• 2026-03-27 - CVE CVE-2025-15612 published to NVD
• 2026-03-30 - Last updated in NVD database

Technical Details for CVE-2025-15612

Vulnerability Analysis

This vulnerability falls under CWE-295 (Improper Certificate Validation), a certificate validation bypass weakness that affects the integrity of the software supply chain. When curl is invoked with the -k or --insecure flag, it completely bypasses SSL/TLS certificate verification, accepting any certificate regardless of validity, expiration, or issuing authority.

The attack surface requires network-level access to intercept communications between the build environment and remote servers hosting dependencies. While the attack complexity is higher due to the need for network positioning, successful exploitation requires no privileges or user interaction once an attacker achieves man-in-the-middle positioning.

The primary impact is on confidentiality and integrity of the build process. Attackers can inject malicious code into downloaded scripts, binaries, or dependencies, which then execute during the build phase with full system privileges.

Root Cause

The root cause is the explicit use of the -k or --insecure flag in curl commands within provisioning scripts and Dockerfiles. This flag instructs curl to skip all SSL/TLS certificate validation checks, including:

• Certificate chain verification against trusted certificate authorities
• Certificate expiration date validation
• Hostname verification against certificate subject/SAN fields
• Certificate revocation status checks

This practice is often introduced as a workaround for development environments with self-signed certificates but becomes a significant security risk when left in production-facing scripts.

Attack Vector

The vulnerability is exploited through network-based man-in-the-middle (MITM) attacks. An attacker positioned on the network path between the build system and remote dependency servers can:

1. Intercept HTTPS connections that would normally be secured
2. Present a fraudulent SSL certificate (which curl accepts due to the -k flag)
3. Serve modified or entirely malicious content in place of legitimate dependencies
4. Inject backdoors, malware, or other malicious code into the build process

This exploitation technique represents a supply chain attack vector, where compromising the build infrastructure can affect all downstream deployments built using the vulnerable scripts.

Detection Methods for CVE-2025-15612

Indicators of Compromise

• Presence of -k or --insecure flags in curl commands within provisioning scripts and Dockerfiles
• Unexpected network traffic patterns during build processes
• Modified checksums of downloaded dependencies compared to known-good hashes
• Evidence of certificate errors or warnings being suppressed in build logs

Detection Strategies

• Scan all provisioning scripts and Dockerfiles for usage of curl -k or curl --insecure patterns
• Implement code review processes that flag insecure transport configurations before deployment
• Deploy network intrusion detection systems to identify potential MITM attacks on build infrastructure
• Verify cryptographic hashes of all downloaded dependencies against vendor-published checksums

Monitoring Recommendations

• Monitor build system network connections for unexpected certificate warnings or SSL/TLS anomalies
• Implement logging and alerting for any build processes that download external dependencies
• Review and audit build infrastructure network configurations to ensure proper segmentation
• Establish baseline behavior for build processes and alert on deviations

How to Mitigate CVE-2025-15612

Immediate Actions Required

• Audit all Wazuh provisioning scripts and Dockerfiles for curl commands using the -k or --insecure flag
• Remove the -k/--insecure flag and configure proper SSL/TLS certificate validation
• Verify the integrity of any builds performed using the vulnerable scripts
• Implement network segmentation to isolate build infrastructure from untrusted networks

Patch Information

Organizations should review the GitHub Security Advisory for official remediation guidance. The fix involves removing insecure curl flags and ensuring proper certificate validation is enabled for all HTTPS connections during the build process.

Additional technical details are available in the VulnCheck Security Advisory.

Workarounds

• Replace -k/--insecure flags with proper certificate chain configuration using --cacert to specify trusted CA bundles
• If self-signed certificates are required in development, use --cacert with the specific self-signed certificate instead of disabling validation entirely
• Implement checksum verification for all downloaded dependencies regardless of transport security
• Use pinned certificate validation where possible for critical dependencies

# Secure curl configuration example
# Instead of: curl -k https://example.com/dependency.tar.gz
# Use proper certificate validation:
curl --cacert /etc/ssl/certs/ca-certificates.crt https://example.com/dependency.tar.gz -o dependency.tar.gz

# Verify checksum after download
sha256sum -c dependency.tar.gz.sha256