Stack-based Buffer Overflow Affecting wazuh/wazuh package, versions [3.9.0, 4.14.3)

Affected versions of this package are vulnerable to Stack-based Buffer Overflow through the FillScanInfo and FillCheckEventInfo JSON parsing functions in src/analysisd/decoders/security_configuration_assessment.c. An attacker can crash the Wazuh manager by sending a specially crafted SCA JSON event containing floating-point values that expand beyond the fixed 128-byte stack buffer.

#include <stdio.h>
#include <string.h>

#define OS_SIZE_128 128

/**
 * This function isolates the vulnerable code pattern.
 */
void vulnerable_function(double bad_double) {
    char value[OS_SIZE_128]; // The 128-byte stack buffer

    printf("Attempting to write to buffer...\n");
    
    // This is the vulnerable call.
    // %lf will try to print a "1" followed by 150 zeros.
    sprintf(value, "%lf", bad_double);

    printf("Buffer write complete. (You shouldn't see this!)\n");
}

int main() {
    // This valid double's string representation is > 128 bytes.
    double overflow_payload = 1.0e150; 

    printf("Starting harness...\n");
    vulnerable_function(overflow_payload);
    printf("Harness finished.\n");

    return 0;
}

• GitHub Advisory
• GitHub Commit