vendor:
Threat Discovery Appliance
by:
Steven Seeley & Roberto Suggi Liverani
9.8
CVSS
HIGH
Remote Code Execution
78
CWE
Product Name: Threat Discovery Appliance
Affected Version From: 2.6.1062r1
Affected Version To: 2.6.1062r1
Patch Exists: YES
Related CWE: N/A
CPE: a:trend_micro:threat_discovery_appliance
Metasploit:
N/A
Other Scripts:
N/A
Platforms Tested: N/A
2020
Trend Micro Threat Discovery Appliance <= 2.6.1062r1 dlp_policy_upload.cgi Remote Code Execution Vulnerability
The vulnerabity is that the dlp_policy_upload.cgi allows the upload of a zip file, located statically as: /var/dlp_policy.zip. The problem is that we can then get that file extracted using admin_dlp.cgi. This gets extracted into 2 locations: - /eng_ptn_stores/prod/sensorSDK/data/ - /eng_ptn_stores/prod/sensorSDK/backup_pol/. We can then use symlinks to craft a symlinked that points to /opt/TrendMicro/MinorityReport/bin/. This is a clever trick, basically, we cant traverse since unzip checks for ../ (even though spec says its ok). We can still exploit this however by extracting a symlink to say a directory and then write into that directory.
Mitigation:
Upgrade to the latest version of Trend Micro Threat Discovery Appliance.