CVE-2020-8446: 
OSSEC vulnerability analysis and mitigation

In OSSEC-HIDS versions 2.7 through 3.5.0, the server component responsible for log analysis (ossec-analysisd) contains a path traversal vulnerability with write access. This vulnerability can be exploited via crafted syscheck messages written directly to the analysisd UNIX domain socket by a local user (CVE Details, GitHub Issue).

The vulnerability exists in the syscheck decoder (src/analysisd/decoders/syscheck.c) where unsafe path handling is performed using the received agent name when trying to get the agent file. The DB_File function uses the unsanitized agent name when building a file name to be used with fopen, allowing for path traversal. The issue occurs when processing syscheck messages, where an attacker can manipulate the path to write files in attacker-controlled locations within the chroot (GitHub Issue).

The vulnerability allows local attackers to write files in arbitrary locations within the chroot environment by manipulating the path through crafted syscheck messages. Remote attackers cannot fully exploit this vulnerability as ossec-remoted ensures the prefix of agent name and source IP is always present (GitHub Issue).

The vulnerability is primarily exploitable by local attackers who can write directly to the ossec queue. This allows full control of the lf->location used as the agent argument to fopen, enabling the creation of syscheck DB files in attacker-controlled locations within the chroot (GitHub Issue).

The vulnerability was fixed in OSSEC-HIDS version 3.6.0. Users should upgrade to this version or later to address the issue. The suggested fix involves using the w_ref_parent_folder function from src/shared/file_op.c on the location field populated by OS_CleanMSG and rejecting any values that have a 1 return from that function (Gentoo Security, GitHub Issue).