Wazuh Heap Buffer Overflow Vulnerability in Analysis Engine Allows Denial-of-Service

A heap buffer overflow vulnerability has been identified in the Wazuh analysis daemon (wazuh-analysisd) in versions 1.0.0 and above, prior to 4.14.5. This vulnerability allows an unauthenticated remote attacker to crash the Wazuh manager's analysis engine, leading to a complete disruption of SIEM alert processing. The issue arises in the default configuration of Wazuh when deployed using Docker. Exploitation involves enrolling an agent without a password to obtain a valid agent ID and encryption key, then sending crafted rootcheck events that exceed 30 bytes, causing a heap corruption that crashes the analysis daemon.

Impact

Exploitation of this vulnerability causes the Wazuh analysis daemon to crash, silently stopping all SIEM alert processing. This disruption is not reflected in the Wazuh dashboard or API, which continue to display outdated information. The analysis daemon can be manually restarted, but the vulnerability can be exploited again immediately after the restart, allowing for repeated disruptions.

Reproduction

The vulnerability can be reproduced by deploying Wazuh version 4.14.4 using the official Wazuh Docker image with the default configuration. After confirming that the Wazuh analysis daemon is running, an attacker can enroll an agent via the Wazuh authd service without a password. Once enrolled, the attacker can connect to the Wazuh remoted service and send rootcheck events containing payloads that exceed 30 bytes. These oversized payloads trigger the buffer overflow by exploiting the JSON event parsing in the Wazuh analysis daemon, leading to heap corruption and crashing the process. This can be automated with a proof-of-concept exploit that mimics the Wazuh agent protocol, including enrollment and encrypted event transmission.

Remediation

Users can update to Wazuh version 4.14.5 or later, where this vulnerability has been patched. Alternatively, as a temporary measure, the Wazuh configuration file can be modified to require passwords for agent enrollment.