CVE-2023-7340: 
Wazuh Agent vulnerability analysis and mitigation

CVE-2023-7340 is a heap-buffer overflow (out-of-bounds read) vulnerability in the Wazuh authentication daemon (wazuh-authd) that allows attackers to cause memory corruption and malformed heap data by sending specially crafted input, resulting in a denial of service condition. It affects Wazuh versions from 3.5.0 through 4.3.10 (inclusive). The vulnerability was originally disclosed via a GitHub Security Advisory on April 14, 2023, and was formally published to CVE databases in March 2026. It carries a CVSS v3.1 base score of 4.3 (Medium) and a CVSS v4.0 base score of 5.3 (Medium) (GitHub Advisory, Red Hat CVE).

The root cause is an out-of-bounds read (CWE-125) in the w_auth_parse_data() function within src/os_auth/auth.c (line 156), where a strncmp operation reads one byte past the end of a heap-allocated buffer when processing a specially crafted authentication message. An attacker can trigger this by sending a malformed OSSEC authentication protocol message — for example, OSSEC PASS: agent1 OSSEC A:'agent4' G:'Group1,Group2,Group1a — to the authd service over the network. The vulnerability was confirmed via AddressSanitizer (ASAN), which reported a heap-buffer-overflow read of size 1 at one byte past a 61-byte heap region. A proof-of-concept fuzzing harness (fuzz.c) and crash input are publicly available in the advisory (GitHub Advisory).

Successful exploitation causes memory corruption in the Wazuh authentication daemon (authd), which can lead to a denial of service condition — crashing or degrading the availability of the authentication service. Because authd handles agent registration and authentication, its disruption could prevent new Wazuh agents from enrolling or authenticating, impacting the security monitoring infrastructure. There is no known confidentiality or integrity impact; the primary consequence is low availability impact to the affected daemon (GitHub Advisory, Red Hat CVE).

1. Reconnaissance: Identify Wazuh manager instances running wazuh-authd (default port 1515/TCP) on versions 3.5.0 through 4.3.10 using network scanning tools such as Nmap (nmap -p 1515 <target>).
2. Craft malicious input: Prepare a specially crafted OSSEC authentication protocol message that causes an out-of-bounds read in w_auth_parse_data(). A known crash input is: OSSEC PASS: agent1 OSSEC A:'agent4' G:'Group1,Group2,Group1a (note the intentionally malformed/truncated group string).
3. Send payload to authd: Transmit the crafted message to the target's authd service on port 1515/TCP using a raw TCP connection (e.g., via nc or a custom script).
4. Trigger crash: The strncmp call in auth.c:156 reads one byte past the end of the heap buffer, causing a heap-buffer-overflow that crashes or corrupts the wazuh-authd process, resulting in denial of service (GitHub Advisory).

• Network: Unexpected or malformed TCP connections to port 1515 (wazuh-authd) from untrusted or external IP addresses; repeated connection attempts with non-standard OSSEC protocol messages.
• Logs: Wazuh manager logs (/var/ossec/logs/ossec.log) showing authd crashes, segmentation faults, or unexpected restarts; ASAN-style error messages if debug builds are deployed.
• Process: Unexpected termination or restart of the wazuh-authd process; child process crashes visible in system logs (/var/log/syslog or journalctl) referencing wazuh-authd.
• File System: Core dump files generated in the Wazuh installation directory (e.g., /var/ossec/) following authd crashes.

No patched version is explicitly listed in the advisory for the affected range (3.5.0–4.3.10); users should upgrade to a Wazuh release beyond 4.3.10 that addresses this issue, and monitor the official Wazuh security advisories for patch availability. As a network-level workaround, restrict access to the authd service (default port 1515/TCP) to trusted IP ranges only using firewall rules, preventing unauthenticated external actors from sending crafted input. Additionally, monitor the wazuh-authd process for unexpected crashes or restarts as an indicator of exploitation attempts (GitHub Advisory).