Stack-Based Buffer Overflow in Wazuh Remote Agent

Executive Summary

This vulnerability exists in Wazuh versions from 4.8.0 up to but not including 4.14.4. It is a stack-based buffer overflow in the function print_hex_string() within wazuh-remoted. The issue occurs when formatting attacker-controlled bytes using sprintf on platforms where the char type is signed and sign-extension happens before the variadic call. For example, input bytes like 0xFF can be incorrectly formatted as "ffffffff" (8 characters) instead of "ff" (2 characters), causing an out-of-bounds write past a fixed 2049-byte stack buffer.

This vulnerable code path can be reached remotely before any agent authentication or registration via TCP port 1514 when an attacker sends an oversized length prefix that triggers an "unexpected message (hex)" diagnostic path. Additionally, this path logs attacker-controlled hex dumps to the log file /var/ossec/logs/ossec.log, which can be abused for remote log amplification, degrading monitoring fidelity and consuming disk and I/O resources.

The issue has been fixed in version 4.14.4.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring network traffic on TCP port 1514 for oversized length prefix messages that trigger the “unexpected message (hex)” diagnostic path in wazuh-remoted. Additionally, examining the /var/ossec/logs/ossec.log file for repeated attacker-controlled hex dump entries can indicate exploitation attempts or log amplification activity.

Since the vulnerability is triggered remotely before agent authentication, network packet inspection tools can be used to detect suspicious oversized messages on TCP/1514.

Suggested commands to help detect this vulnerability include:

• Use tcpdump or similar to capture suspicious packets on TCP port 1514: tcpdump -i <interface> tcp port 1514 and look for unusually large packets.
• Search the Wazuh log file for repeated hex dump entries that may indicate log amplification: grep -i 'unexpected message (hex)' /var/ossec/logs/ossec.log

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to a stack-based buffer overflow, which may allow an attacker to cause a denial of service or potentially execute arbitrary code on the affected system.

Additionally, the vulnerability allows remote attackers to send oversized messages that trigger excessive logging of attacker-controlled data, resulting in log amplification. This can degrade the effectiveness of monitoring systems and consume significant disk space and I/O resources.

Because the vulnerable path is reachable without authentication, attackers can exploit this remotely without needing valid credentials.

Useful 0 Not Useful 0

Compliance Impact

The provided information does not specify any direct impact of this vulnerability on compliance with common standards and regulations such as GDPR or HIPAA.

Useful 0 Not Useful 0

Mitigation Strategies

The immediate mitigation step is to upgrade Wazuh to version 4.14.4 or later, where this stack-based buffer overflow vulnerability has been patched.

Until the upgrade can be applied, consider restricting or blocking incoming traffic on TCP port 1514 from untrusted sources to prevent exploitation attempts.

Additionally, monitor the /var/ossec/logs/ossec.log file for signs of log amplification attacks and ensure sufficient disk space and I/O capacity to handle potential log flooding.

Useful 0 Not Useful 0