Wazuh vulnerabilities

Wazuh provisioning scripts and Dockerfiles contain an insecure transport vulnerability where curl is invoked with the -k/--insecure flag, disabling SSL/TLS certificate validation. Attackers with network access can perform man-in-the-middle attacks to intercept and modify downloaded dependencies or code during the build process, leading to remote code execution and supply chain compromise.

Wazuh version 4.12.0 contains a vulnerability exposing the GITHUB_TOKEN in GitHub Actions workflow artifacts. Attackers can use the exposed token within a limited time window to perform unauthorized actions such as pushing malicious commits or altering release tags.

Wazuh wazuh-agent and wazuh-manager versions 2.1.0 before 4.8.0 contain multiple shell injection and untrusted search path vulnerabilities that allow attackers to execute arbitrary commands through various components including logcollector configuration, maild SMTP server tags, and Kaspersky AR script parameters. Attackers can exploit these vulnerabilities by injecting malicious commands through configuration files, SMTP server settings, and custom flags to achieve remote code execution on affected systems.

In Wazuh from version 3.7.0 to before 4.12.0, the fim_alert() implementation does not check whether oldsum->md5 is NULL before dereferencing it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the Wazuh manager.

In Wazuh from version 4.3.0 to before 4.13.0, a missing ACL on "C:\Program Files (x86)\ossec-agent\authd.pass" exposes the password to all "Authenticated Users" on the local machine. This issue is patched in version 4.13.0.

Wazuh is an open source security detection, visibility, and compliance project. From version 4.9.0 to before 4.13.0, the Wazuh API – Agent Configuration in certain configurations allows authenticated users with read-only API roles to retrieve agent enrollment credentials through the /utils/configuration endpoint.

In Wazuh versions prior to 4.12.0, a buffer over-read occurs in w_expression_match() because the buffer is not properly NULL-terminated during allocation in OS_CleanMSG(). A compromised agent can send a specially crafted message to the Wazuh manager, causing an out-of-bounds read and potential access to sensitive data.

Wazuh, a threat prevention, detection, and response platform, prior to version 4.11.0 contains a vulnerability in the DecodeCiscat() implementation that does not check the return value of cJSON_GetObjectItem() for a possible NULL value on error. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the Wazuh manager. An attacker can cause analysisd to become unavailable.

Prior to 4.11.0, fim_fetch_attributes_state() implementation does not check whether time_string is NULL or not before calling strlen() on it. A compromised agent can cause a crash of analysisd by sending a specially crafted message to the wazuh manager. An attacker who is able to craft and send an agent message to the wazuh manager can cause analysisd to crash and make it unavailable. This vulnerability is fixed in 4.11.0.

In Wazuh prior to 4.11.0, the fim_alert() implementation does not check whether ctime_r returns NULL before calling strdup() on it. A compromised agent can crash analysisd by sending a specially crafted message to the Wazuh manager.

In Wazuh prior to 4.11.0, w_copy_event_for_log() references memory after it has been freed. A compromised agent can send a specially crafted message to the Wazuh manager, potentially compromising application integrity.

In Wazuh prior to 4.10.2, DecodeWinevt() performs a buffer over-read when accessing child_attr[p]->attributes[j] due to an incorrect index j. A compromised agent can send a crafted message to the manager to trigger an out-of-bounds read, potentially leaking data when analysisd.debug=2 is enabled.

A vulnerability in Wazuh: a heap-based out-of-bounds WRITE in decode_win_permissions writes a NULL byte 2 bytes before the start of the buffer allocated for decoded_it. A compromised agent can send a specially crafted message to the Wazuh manager, potentially achieving remote code execution on the manager (exploitability depends on the specific heap allocator).

A vulnerability in Wazuh's fillData() implementation that does not check whether value is NULL before calling os_strdup(). A compromised agent can crash analysisd by sending a specially crafted message to the Wazuh manager.

Wazuh versions starting from 3.8.0 to before 4.11.0 have a heap buffer overflow vulnerability in wazuh-analysisd when parsing XML elements from Windows EventChannel messages. This is patched in version 4.11.0.