Wazuh NULL Pointer Dereference Vulnerability in Inventory Sync FlatBuffer Handling

A null pointer dereference vulnerability has been identified in Wazuh versions prior to 5.0.0-beta3, specifically within the 'wazuh-modulesd' component's handling of FlatBuffer 'DataValue' messages during inventory synchronization. This vulnerability allows an enrolled agent to send a valid 'DataValue' message that omits the optional 'id' field. The 'wazuh-modulesd' process crashes when it attempts to dereference 'data->id()->string_view()' without checking for null, leading to a denial-of-service condition.

Impact

Exploitation of this vulnerability causes the 'wazuh-modulesd' process to crash, disrupting inventory synchronization and potentially creating a crash loop if the service is automatically restarted.

Reproduction

The vulnerability can be reproduced by sending a FlatBuffer 'DataValue' message through the Wazuh agent that omits the 'id' field. This can be done using a local harness that constructs such a message, verifies its validity, and then sends it, causing the 'wazuh-modulesd' process to crash.

Remediation

Users can update to Wazuh version 5.0.0-beta3 or later, where this vulnerability has been patched.