Uncontrolled YAML Alias Expansion in Wazuh

Executive Summary

This vulnerability is a memory exhaustion issue in Wazuh versions 3.9.0 to 4.14.7 caused by uncontrolled YAML alias expansion during SCA policy parsing. Attackers with manager access can push a malicious policy with nested YAML aliases to agents, triggering exponential memory growth and crashing the wazuh-modulesd process via a 'billion laughs' attack pattern.

Useful 0 Not Useful 0

Detection Guidance

Monitor for crashes in wazuh-modulesd processes on agents, which may indicate memory exhaustion from YAML alias expansion. Check logs for OOM killer events or excessive memory usage in Wazuh agent logs. Use system monitoring tools like top, htop, or ps to observe memory consumption spikes in wazuh-modulesd.

Useful 0 Not Useful 0

Impact Analysis

Exploitation can crash the wazuh-modulesd process on all agents in a group, disabling monitoring and requiring manual recovery. A small 1 KB policy file can take down an entire agent fleet by consuming excessive memory, leading to denial-of-service conditions.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could impact compliance with GDPR and HIPAA by causing denial-of-service conditions that disrupt monitoring and logging systems. GDPR requires maintaining data processing logs, while HIPAA mandates continuous monitoring of systems handling protected health information. A DoS condition from this vulnerability may lead to gaps in audit trails or monitoring, potentially violating these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Upgrade Wazuh manager and all agents to version 4.14.8 or later to apply the fix for YAML alias expansion limits. Disable YAML aliases in SCA policies if possible. Implement input size limits and recursion depth checks for YAML parsing. Validate and sign SCA policies before deployment to prevent tampering.

Useful 0 Not Useful 0