CVE-2025-62791: Wazuh Denial of Service Vulnerability

CVE-2025-62791 Overview

CVE-2025-62791 is a Null Pointer Dereference vulnerability affecting Wazuh, a free and open source platform used for threat prevention, detection, and response. The vulnerability exists in the DecodeCiscat() function implementation, which fails to check the return value of cJSON_GetObjectItem() for a possible NULL value in case of an error. This oversight allows a compromised agent to crash the analysisd component by sending a specially crafted message to the Wazuh manager.

Critical Impact

A compromised agent or attacker capable of crafting malicious messages can cause the Wazuh manager's analysisd process to crash, resulting in denial of service and potential loss of security monitoring capabilities.

Affected Products

• Wazuh versions prior to 4.11.0

Discovery Timeline

• 2025-10-29 - CVE-2025-62791 published to NVD
• 2025-11-03 - Last updated in NVD database

Technical Details for CVE-2025-62791

Vulnerability Analysis

This vulnerability stems from improper error handling in the DecodeCiscat() function within the Wazuh codebase. The function uses cJSON_GetObjectItem() to parse JSON data from agent messages but does not validate whether the returned pointer is NULL before dereferencing it. In C programming, when cJSON_GetObjectItem() cannot find the requested key or encounters a parsing error, it returns NULL. Attempting to access members of a NULL pointer results in undefined behavior, typically manifesting as a segmentation fault that crashes the process.

The vulnerability is classified under CWE-252 (Unchecked Return Value) and CWE-476 (NULL Pointer Dereference), highlighting the dual nature of the flaw: both the failure to check return values and the subsequent unsafe pointer dereference.

Root Cause

The root cause is the absence of NULL pointer validation after calling cJSON_GetObjectItem() in the DecodeCiscat() function. The function assumes that JSON parsing will always succeed and that all expected fields will be present in the incoming message. When a malformed or malicious message is received that lacks expected fields or contains invalid JSON structures, the parsing function returns NULL, which is then dereferenced without proper validation.

Attack Vector

The attack vector is network-based, requiring an attacker to either compromise an existing Wazuh agent or have the ability to send crafted messages that mimic agent communications to the Wazuh manager. The attack flow involves:

1. The attacker crafts a specially formatted message that will cause cJSON_GetObjectItem() to return NULL when processed by DecodeCiscat()
2. The malicious message is sent to the Wazuh manager through the agent-manager communication channel
3. When analysisd processes the message, it attempts to dereference the NULL pointer
4. The analysisd process crashes, disrupting security monitoring and event analysis

The vulnerability does not require user interaction and can be exploited remotely, though it requires network access to the Wazuh manager's agent communication interface. The impact is limited to availability (denial of service) with no direct confidentiality or integrity impact.

Detection Methods for CVE-2025-62791

Indicators of Compromise

• Unexpected crashes or restarts of the analysisd process on Wazuh manager
• Segmentation fault errors in Wazuh manager logs associated with analysisd
• Abnormal or malformed messages in agent-to-manager communication logs
• Gaps in security event processing or monitoring coverage

Detection Strategies

• Monitor Wazuh manager process stability, specifically tracking analysisd process crashes and restarts
• Implement log analysis for segmentation fault signals (SIGSEGV) in Wazuh manager system logs
• Review agent communication logs for messages with missing or malformed CISCAT-related JSON fields
• Configure alerting on unexpected service interruptions of Wazuh manager components

Monitoring Recommendations

• Enable process monitoring for the analysisd daemon with automatic restart detection
• Configure syslog monitoring for crash-related entries from Wazuh components
• Establish baseline metrics for agent message processing to detect anomalous traffic patterns
• Implement health checks that validate Wazuh manager component availability

How to Mitigate CVE-2025-62791

Immediate Actions Required

• Upgrade Wazuh to version 4.11.0 or later, which contains the fix for this vulnerability
• Review agent integrity and ensure all connected agents are trusted and properly authenticated
• Implement network segmentation to restrict access to Wazuh manager communication ports
• Enable process supervision to automatically restart analysisd if crashes occur

Patch Information

This vulnerability is fixed in Wazuh version 4.11.0. Organizations should upgrade to this version or later to remediate the vulnerability. The fix implements proper NULL pointer validation after cJSON_GetObjectItem() calls in the DecodeCiscat() function. For detailed information about the security fix, refer to the GitHub Security Advisory.

Workarounds

• If immediate patching is not possible, implement strict network access controls to limit which systems can communicate with the Wazuh manager
• Configure firewall rules to restrict agent-to-manager communication to known, trusted agent IP addresses
• Enable process monitoring and automatic restart for the analysisd service to minimize downtime during exploitation attempts
• Consider temporarily disabling CISCAT processing if not critical to operations until patching can be completed

# Example: Configure systemd to automatically restart analysisd on failure
# Add to /etc/systemd/system/wazuh-manager.service.d/override.conf
[Service]
Restart=always
RestartSec=5