Karasu-Hakira

An uncontrolled YAML alias expansion issue exists in the `yaml2json node` component. This allows a manager-controlled policy to exhaust agent memory. An attacker with control over the manager can push a small SCA policy containing nested aliases via `merged.mg` to trigger an Out-Of-Memory (OOM) condition, which kills the `wazuh-modulesd` process on every agent within a group.

A flaw in the cluster file synchronization process allows an entity possessing the cluster key to write, overwrite, or delete arbitrary files within the `/var/ossec` directory on worker nodes, potentially resulting in remote code execution with root privileges. The issue occurs in the non-merged branch of the `update master files in worker()` function, where files are moved to a destination using `safe join()`. While this confines the path to `/var/ossec`, the system fails to verify if the file is placed in the directory specified by its `cluster item key`. This lack of destination verification, which is present on the primary node and the worker's merged branch, allows a peer to place files in attacker-controlled locations within `/var/ossec` that are executed as root. The delete branch contains the same deficiency.