PT-2023-9080 · Wazuh · Wazuh Manager

D0Ntrash · Published 2023-11-28 · Updated 2025-01-09 · CVE-2024-32038

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Wazuh Manager versions 3.8.0 through 4.7.1

Description The issue is related to a buffer overflow hazard in the wazuh-analysisd service when handling Unicode characters from Windows Eventchannel messages. This can be exploited by a remote attacker to execute arbitrary code. The vulnerability is associated with the incorrect handling of XML files containing Unicode characters by the cJSON PrintUnformatted() function.

Recommendations For Wazuh Manager versions 3.8.0 through 4.7.1, update to Wazuh Manager 4.7.2 to resolve the issue. As a temporary workaround, consider restricting the handling of Unicode characters from Windows Eventchannel messages in the wazuh-analysisd service until a patch is applied.

Exploit

Fix

Heap Based Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-122

CWE-787

Related Identifiers

BDU:2024-03461

CVE-2024-32038

GHSA-FCPW-V3PG-C327

ZDI-24-397

Affected Products

Wazuh Manager

References · 15

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32038.json · Exploit
• https://github.com/wazuh/wazuh/security/advisories/GHSA-fcpw-v3pg-c327 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/707406 · Security Note
• https://bdu.fstec.ru/vul/2024-03461 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-397 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32038 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-32038 · Security Note
• https://github.com/wazuh/wazuh/issues/20657 · Note
• https://github.com/wazuh/wazuh/pull/20658 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-32038 · Note
• https://documentation.wazuh.com/current/release-notes/release-4-7-2.html · Note
• https://t.me/cvenotify/106958 · Telegram Post
• https://t.me/cvenotify/77450 · Telegram Post
• https://vuldb.com/ru/?id.261617 · Note
• https://t.me/cvenotify/77470 · Telegram Post