Wazuh Agent for Windows Heap-Based Buffer Overflow Vulnerability in Syscheck Component Allowing Local Privilege Escalation and Denial-of-Service

A heap-based buffer overflow vulnerability has been identified in the Wazuh agent for Windows, specifically in the syscheck component. This vulnerability affects Wazuh versions 4.6.0 and above, prior to 4.14.5. The issue arises when the agent expands registry paths containing wildcards, leading to an out-of-bounds write during string concatenation. A low-privileged local attacker can exploit this by creating a registry subkey with a maximum length of 255 characters inside a monitored path. Since the Wazuh agent runs with NT AUTHORITY\SYSTEM privileges, this vulnerability can cause a silent denial-of-service by crashing the agent or potentially allow local privilege escalation.

Impact

Exploitation of this vulnerability can lead to a denial-of-service condition, causing the Wazuh agent to crash and disrupting endpoint monitoring. Additionally, there is potential for local privilege escalation, as an attacker could manipulate the heap memory to gain NT AUTHORITY\SYSTEM privileges.

Reproduction

To reproduce this vulnerability, configure the Wazuh Windows agent to monitor a registry path with a wildcard that a low-privileged user can write to. This can be done by editing the 'ossec.conf' file to include a registry path such as 'HKEY_CURRENT_USER\Software\WazuhTest\*'. After saving the configuration, log in as a standard user and use PowerShell to create a subkey under 'HKEY_CURRENT_USER\Software\WazuhTest\' with 255 characters. Once the subkey is created, the Wazuh agent will crash when it processes the wildcard path, due to a 'STATUS_HEAP_CORRUPTION' exception.

Remediation

Users can upgrade to Wazuh version 4.14.5 or later to address this vulnerability.