Stack-based Buffer Overflow Affecting wazuh/wazuh package, versions [4.4.0, 4.14.3)

Affected versions of this package are vulnerable to Stack-based Buffer Overflow via the query-building loop in the wdb_upsert_dbsync and wdb_delete_dbsync functions in src/wazuh_db/wdb_delta_event.c. An attacker can corrupt the stack and cause a denial of service by supplying a database synchronization payload that makes the SQL query exceed the fixed 2048-byte buffer. The issue arises when repeated snprintf calls are used to append SQL fragments while directly accumulating their return values. Once truncation occurs, the remaining-size calculation can underflow and be treated as a very large unsigned value on the next write.

#include <stdio.h>
#include <stdlib.h>
#include <string.h>

// Small buffer to trigger overflow easily
#define QUERY_MAX_SIZE 20 

void vulnerable_logic_path() {
    char query[QUERY_MAX_SIZE] = {0};
    int query_actual_size = 0;
    
    printf("[*] Buffer size: %d\n", QUERY_MAX_SIZE);

    // Iteration 1: Fill the buffer mostly up
    // snprintf returns 15. query_actual_size becomes 15.
    query_actual_size += snprintf(query + query_actual_size, 
                                  QUERY_MAX_SIZE - query_actual_size - 1, 
                                  "AAAAAAAAAAAAAAA"); 

    // Iteration 2: Attempt to write more than remains.
    // Remaining space calculation: 20 - 15 - 1 = 4 bytes.
    // We try to write 10 bytes ("BBBBBBBBBB").
    // snprintf truncates, but RETURNS 10 (required size).
    // query_actual_size becomes 15 + 10 = 25.
    query_actual_size += snprintf(query + query_actual_size, 
                                  QUERY_MAX_SIZE - query_actual_size - 1, 
                                  "BBBBBBBBBB");

    printf("[!] Current accumulator: %d (Exceeds max size %d)\n", query_actual_size, QUERY_MAX_SIZE);

    // Iteration 3: The Overflow
    // Remaining space calculation: 20 - 25 - 1 = -6.
    // (size_t)-6 is a huge number. snprintf writes without bounds.
    printf("[!] Triggering unbounded write...\n");
    query_actual_size += snprintf(query + query_actual_size, 
                                  (size_t)(QUERY_MAX_SIZE - query_actual_size - 1), 
                                  "CCCCCCCCCCCCCCCCCCCCCCCCCCCCCC"); 
}

int main() {
    printf("=== Wazuh wdb_delta_event.c Snprintf Overflow PoC ===\n");
    vulnerable_logic_path();
    return 0;
}

• GitHub Commit
• GitHub Commit
• Maintainer's Advisory