A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e., \PCCSRV\TEMP\SampleSubmission) on the server. The attacker can upload a large number of large files to fill up the file system on which the Apex One server is installed.

According to its self-reported version, the Trend Micro application running on the remote Windows host is Apex One prior to SP1 (Server Build 11564 and Agent Build 11564). It is, therefore, affected by multiple vulnerabilities:

  - An uncontrolled search path element vulnerability in the Trend Micro Apex One Server     installer could allow an attacker to achieve a remote code execution state on affected     products. (CVE-2023-25143)     
  - An improper access control vulnerability in the Trend Micro Apex One agent could allow     a local attacker to gain elevated privileges and create arbitrary directories with     arbitrary ownership. (CVE-2023-25144)     
  - A link following vulnerability in the scanning function of Trend Micro Apex One agent     could allow a local attacker to escalate privileges on affected installations.     (CVE-2023-25145)     
  - A security agent link following vulnerability in the Trend Micro Apex One agent could     allow a local attacker to quarantine a file, delete the original folder and replace with     a junction to an arbitrary location, ultimately leading to an arbitrary file dropped to     an arbitrary location. (CVE-2023-25146)     
  - An issue in the Trend Micro Apex One agent could allow an attacker who has previously     acquired administrative rights via other means to bypass the protection by using a     specifically crafted DLL during a specific update process. (CVE-2023-25147)     
  - A security agent link following vulnerability in Trend Micro Apex One could allow a local     attacker to exploit the vulnerability by changing a specific file into a pseudo-symlink,     allowing privilege escalation on affected installations. (CVE-2023-25148)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version   number.

Detections

Analytics

CVE-2023-0587

critical

Tenable Plugins

critical