Wazuh: FIM/WinEvtChannel seems to not being validating input format

[jesusgn90]

|Wazuh version|Component|Install type|Install method|Platform|
|---|---|---|---|---|
| 3.10.0-31006 | ossec-analysisd | Manager | Sources | CentOS 7 |

Branch: dev-full-summary-endpoint-426
Branch _HEAD_ of my copy: 07dad18ad28dbe7f732f337316034b5a135df8ff

Description

If an event expected to be a WinEvtChannel event comes with the wrong format, ossec-analysisd goes down, after that, ossec-remoted goes down too. Then, our Wazuh manager would be in the wrong state obviously.

How to reproduce

Send a message directly to the Wazuh manager as a WinEvtChannel message but using the wrong format.

Another ticket https://github.com/wazuh/wazuh/issues/3442 we can see a Python script to easily send messages to the queue.

Just sending a single message would produce the error:

$ ./queue.py 'f:/home:bar'

The f refers to WinEvtChannel as seen in https://github.com/wazuh/wazuh/blob/2f0884efd0dcb47e2b2588ef492ecdcb6288c993/src/headers/mq_op.h#L33.

Extra details

Logs:

...
2019/08/20 11:37:37 ossec-logcollector: ERROR: socketerr (not available).
2019/08/20 11:37:37 ossec-remoted: ERROR: socketerr (not available).
2019/08/20 11:37:37 ossec-remoted: ERROR: (1210): Queue '/queue/ossec/queue' not accessible: 'Connection refused'.
2019/08/20 11:37:38 ossec-remoted: ERROR: socketerr (not available).
2019/08/20 11:37:38 ossec-remoted: ERROR: (1210): Queue '/queue/ossec/queue' not accessible: 'Bad file descriptor'.
2019/08/20 11:37:39 ossec-remoted: ERROR: socketerr (not available).
2019/08/20 11:37:39 ossec-remoted: ERROR: (1210): Queue '/queue/ossec/queue' not accessible: 'Bad file descriptor'.
2019/08/20 11:37:40 ossec-remoted: ERROR: socketerr (not available).
2019/08/20 11:37:40 ossec-remoted: ERROR: (1210): Queue '/queue/ossec/queue' not accessible: 'Bad file descriptor'.
2019/08/20 11:37:47 ossec-logcollector: ERROR: socketerr (not available).
2019/08/20 11:37:47 ossec-logcollector: ERROR: socketerr (not available).
...

I can also give you a core dump file from GDB if needed, but I think is pretty easy to reproduce.

[vikman90]

@jesusgn90 thank you very much for describing this issue.

I guess it's due to a mischecking of the input payload. Let us investigate that.

Cheers.

[jlruizmlg]

Any status in this issue?

Thanks!

[chemamartinez]

Hi @vikman90, @jlruizmlg,

It is solved in this PR https://github.com/wazuh/wazuh/pull/3320, included in 3.11.0. It fixes the way that the EventChannel logs decoder handles the incoming events. Now, when an unexpected event arrives, analysisd shows the following error:

 2019/11/25 02:37:58 ossec-analysisd[2831] winevtchannel.c:177 at DecodeWinevt(): ERROR: Malformed EventChannel JSON event.

Let me close the issue.

Regards.