Wazuh Manager Denial-of-Service and Potential Heap Overflow Vulnerability

A size_t integer underflow vulnerability has been identified in Wazuh Manager versions 3.0.0 and above, prior to 4.14.5. The issue resides in the 'ReadSecMSG' function of 'os_crypto/shared/msgs.c', where the absence of a minimum-length guard allows enrolled Wazuh agents to send crafted messages that cause the 'wazuh-remoted' process to crash. This disconnection affects all agents connected to the manager. Additionally, the same underflow could lead to heap memory corruption, potentially allowing remote code execution as the 'wazuh' user, depending on the behavior of 'malloc(0)' and the runtime memory layout.

Impact

Exploitation of this vulnerability causes a complete denial-of-service by crashing the 'wazuh-remoted' process, disconnecting all agents from the manager. This disruption halts security monitoring across the entire monitored infrastructure. Furthermore, the vulnerability could be exploited to corrupt heap memory, with the potential for remote code execution as the 'wazuh' user.

Reproduction

To reproduce this vulnerability, a valid enrolled Wazuh agent must be used. The vulnerability can be triggered by sending a compressed message from the agent to the manager. The decompressed message must be between 1 and 52 bytes and pass the checksum validation. The underflow occurs because the 'ReadSecMSG' function unconditionally advances the message pointer by 53 bytes after decompression, without checking if the remaining size is sufficient. This oversight allows the message length to wrap around, creating a size_t underflow that can be exploited.

Remediation

Users can upgrade to Wazuh Manager version 4.14.5, where this vulnerability has been fixed.