Vikman90

An out-of-bounds write issue exists in the `wazuh-execd` component. Privileged attackers with access to the manager configuration can corrupt root process memory by providing excessive `ar.conf` entries. Specifically, by controlling the active-response blocks in `ossec.conf`, an attacker can send more than 64 commands to agents, which overflows the arrays in the `ReadExecConfig()` function and causes a fleet-wide crash of the Active Response system.

A stack-based buffer overflow exists in the logcollector snort-full log reader due to a miscalculation of remaining buffer space in the `read snortfull()` function. An attacker can trigger this by writing specially crafted multi-line content to a monitored snort-full log, which may overflow the 65,280-byte stack buffer. This can result in the agent crashing or the overwriting of a Structured Exception Handler (SEH)—a mechanism used to handle software errors—on 32-bit Windows agents operating with SYSTEM privileges.

A memory leak exists in the generic JSON decoder. Remote attackers can exhaust the memory of the `wazuh-analysisd` process by sending events containing repeated static fields, such as `id`. This can be achieved by enrolling an agent through passwordless enrollment, eventually triggering an Out-Of-Memory (OOM) kill, which disables alerting functionality.

A server-side request forgery issue exists in the Azure wodle `get graph events()` function. The function follows the `@odata.nextLink` variable without performing host or HTTPS validation. This allows attackers who can influence the `@odata.nextLink` value to redirect manager requests to endpoints under their control, enabling the capture of the reused Microsoft Graph bearer token and access to internal services.

A server-side request forgery (SSRF) issue exists in the GitHub module (wm github.c). The system trusts unvalidated Link rel="next" pagination URLs, allowing an attacker who controls the next-page URL to force the manager to send requests containing the GitHub API token to external hosts. This can lead to the exposure of organization repositories and settings.

The fluent-forward module contains a flaw in the `wm fluent ssl ctx()` function due to missing TLS hostname verification. This allows a network attacker to impersonate a Fluentd collector by presenting any certificate that chains to the configured `ca file`. By redirecting the connection through DNS, ARP, or on-path positions, an attacker can intercept forwarded security telemetry and obtain the `shared key hexdigest` for offline cracking.

A remote code execution issue exists where the trust for Security Configuration Assessment (SCA) policies is determined by the file path instead of the configuration source. An attacker with control over a manager can write unsigned policy files to the `var/incoming` directory using the upgrade channel and reference them to execute command checks with root privileges on agents.

The software fails to invalidate issued tokens for run as users who have zero static roles. This occurs because the `check token()` function does not consult the blacklist. Consequently, attackers whose administrator grants have been revoked can continue to authenticate and self-link the administrator role to maintain privileged access permanently.

An arbitrary file overwrite issue exists in the `MasterHandler.process files from worker()` function. A compromised cluster worker can bypass protections using a trailing-slash basename bypass and the absence of `extra valid` enforcement to overwrite protected master files, specifically `ossec.conf` and `agent.conf`. This allows for root remote code execution across the manager and all associated agents. Exploitation requires a cluster key or privileged API access.

A case-sensitivity mismatch exists between the ossec.conf validator and wazuh-logcollector, allowing the bypass of remote-command validation. Authenticated users possessing the `manager:update config` permission can inject an uppercase `LOG FORMAT` command `localfile`, which the collector then executes as root upon reload.

A path traversal issue exists in the `upload list file`, `upload rule file`, and `upload decoder file` functions. Attackers possessing the cluster key can send DistributedAPI requests containing `../` sequences in the `filename` variable, bypassing REST controller validation. This allows malicious cluster workers to write files to arbitrary paths as the wazuh user. Path traversal is a technique used to access files and directories that are stored outside the web root folder.

A heap buffer overflow exists in the `fim generate alert()` function. The issue occurs because the `full log` variable is sized based on input but written with a boundary defined by `OS MAXSTR`. An enrolled agent can exploit this by sending a specially crafted FIM syscheck event to corrupt the manager heap memory, leading to a deterministic crash of the `wazuh-analysisd` process and resulting in a fleet-wide detection outage.

An information disclosure issue allows low-privileged users with `agent:read` permissions to retrieve the plaintext `authd.pass` enrollment password. This occurs via an unmasked agent configuration endpoint. Users with the default readonly role can request the auth component configuration for pseudo-agent ID `000` to obtain the secret, which could enable the enrollment of rogue agents against the manager.

A race condition exists in the API login throttling mechanism. This allows unauthenticated attackers to bypass the `max login attempts` limit by sending concurrent requests. By firing bursts of simultaneous login attempts to the 'authenticate' and 'run as' endpoints, an attacker can pass the block check before previous failures are recorded, facilitating unlimited password guessing.

A path traversal issue exists in the `get list file` helper. This allows malicious cluster workers who possess the cluster key to read arbitrary files by providing unvalidated filename values through DistributedAPI requests. This can lead to the exposure of sensitive files such as `client.keys` and `ossec.conf`.

An uncontrolled YAML alias expansion issue exists in the `yaml2json node` component. This allows a manager-controlled policy to exhaust agent memory. An attacker with control over the manager can push a small SCA policy containing nested aliases via `merged.mg` to trigger an Out-Of-Memory (OOM) condition, which kills the `wazuh-modulesd` process on every agent within a group.

A path traversal issue exists in the `delete rule file` and `delete decoder file` helpers. This allows malicious cluster workers possessing the cluster key to delete arbitrary files, such as `ossec.conf`, `client.keys`, or rules, by sending traversal sequences through the DistributedAPI via an unvalidated `filename` parameter. Path traversal is a technique used to access files and directories that are stored outside the web root folder by manipulating variables such as file paths.

An authorization bypass allows low-privileged authenticated users to read the Role-Based Access Control (RBAC) catalog. By querying unprotected security endpoints, attackers can map privileged actions and endpoints to plan privilege escalation. The affected API endpoints are 'GET /security/actions' and 'GET /security/resources', which fail to apply the caller's RBAC policies.

A path traversal issue exists in the CDB list handlers within the `get lists()` and `delete list file()` functions. This allows compromised cluster workers to read or delete master files by sending traversal or absolute-path filenames through the internal cluster RPC path, which bypasses REST validation and Role-Based Access Control (RBAC). An example of a targetable file is `rbac.db`.

A missing origin check in the `wm agent upgrade` function allows enrolled agents to issue `upgrade custom` commands using an attacker-controlled `file path` variable. This allows attackers to inject an `upgrade custom` message over the agent channel to read arbitrary files with root privileges, potentially exfiltrating sensitive files such as `/etc/shadow` and `client.keys`.