Investigate possible vulnerabilities when using subprocess in the framework/ directory

[mcarmona99]

Description

With the test created in the issue wazuh/wazuh-qa#1615, some possible code flaws were found by Bandit.

In this issue we specify flaws regarding the use of subprocess calls in framework/.

In total, we have 11 possible vulnerabilities with the use of subprocess.

• framework/wazuh/core/cluster/cluster.py line 39
• framework/wazuh/core/common.py line 62
• framework/wazuh/core/configuration.py line 713
• framework/wazuh/core/utils.py line 112
• framework/scripts/wazuh-logtest.py line 421
• framework/wazuh/core/cluster/cluster.py line 39
• framework/scripts/wazuh-logtest.py line 14
• framework/wazuh/core/cluster/cluster.py line 14
• framework/wazuh/core/common.py line 7
• framework/wazuh/core/configuration.py line 9
• framework/wazuh/core/utils.py line 24

The last 5 vulnerabilities are also due to the use of subprocess but the difference is that these possible flaws were just telling to consider the possible security implications of importing subprocess, instead of its usage.

Vulnerability when using subprocess:

Issue text: subprocess call - check for execution of untrusted input.

More info.: https://bandit.readthedocs.io/en/latest/plugins/b603_subprocess_without_shell_equals_true.html

Vulnerability when importing subprocess:

Issue text: Consider possible security implications associated with subprocess module.

More info.: https://bandit.readthedocs.io/en/latest/blacklists/blacklist_imports.html#b404-import-subprocess

We should investigate these results and see if they are real vulnerabilities.

Checks

wazuh/wazuh

• Unit tests without failures. Updated and/or expanded if there are new functions/methods/outputs:
  • Cluster (framework/wazuh/core/cluster/tests/ & framework/wazuh/core/cluster/dapi/tests/)
  • Core (framework/wazuh/core/tests/)
  • SDK (framework/wazuh/tests/)
  • RBAC (framework/wazuh/rbac/tests/)
  • API (api/api/tests/)
• API tavern integration tests without failures. Updated and/or expanded if needed (api/test/integration/):
  • Affected tests
  • Affected RBAC (black and white) tests
• Review integration test mapping using the script (api/test/integration/mapping/integration_test_api_endpoints.json)
• Review of spec.yaml examples and schemas (api/api/spec/spec.yaml)
• Review exceptions remediation when any endpoint path changes or is removed (framework/wazuh/core/exception.py)
• Changelog (CHANGELOG.md)

wazuh/wazuh-documentation

• Migration from 3.X for changed endpoints (source/user-manual/api/equivalence.rst)
• Update RBAC reference with new/modified actions/resources/relationships (source/user-manual/api/rbac/reference.rst)

[Kondent]

Update

I've finished the investigation on this issue. The report is available at related pull request.

Regards,
Alexis