Exploit-DB #43388
Description: Trend Micro Smart Protection Server - Session Hijacking / Log File Disclosure / Remote Command Execution / Cron Job Injection / Local File Inclusion / Stored Cross-Site Scripting / Improper Access Control
Type: remote
Platform: multiple
Date: 2017-12-19
Author: CoreLabs

Exploit:
# Trend Micro Smart Protection Server Multiple Vulnerabilities

## 1. Advisory Information

**Title:**: Trend Micro Smart Protection Server Multiple Vulnerabilities  
**Advisory ID:** CORE-2017-0008  
**Advisory URL:** http://www.coresecurity.com/advisories/trend-micro-smart-protection-server-multiple-vulnerabilities
**Date published:** 2017-12-19  
**Date of last update:** 2017-12-11  
**Vendors contacted:** Trend Micro  
**Release mode:** Coordinated release



## 2. Vulnerability Information

**Class:** Information Exposure Through Log Files [[CWE-532](http://cwe.mitre.org/data/definitions/532.html)], Improper Neutralization of Special Elements used in an OS Command [[CWE-78](http://cwe.mitre.org/data/definitions/78.html)], Improper Control of Filename for Include/Require Statement in PHP Program [[CWE-98](http://cwe.mitre.org/data/definitions/98.html)], Improper Neutralization of Input During Web Page Generation [[CWE-79](http://cwe.mitre.org/data/definitions/79.html)], Improper Authorization [[CWE-285](http://cwe.mitre.org/data/definitions/285.html)]  
**Impact:** Code execution  
**Remotely Exploitable:** Yes  
**Locally Exploitable:** Yes  
**CVE Name:** [CVE-2017-11398](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-11398), [CVE-2017-14094](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14094), [CVE-2017-14095](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14095), [CVE-2017-14096](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14096), [CVE-2017-14097](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14097)



## 3. Vulnerability Description

Trend Micro's website states that:

Trend Micro Smart Protection Server [(http://cwe.mitre.org/data/definitions/532.html)(https://www.coresecurity.com#SPS)] is a next-generation, in-the-cloud based, advanced protection solution. At the core of this solution is an advanced scanning architecture that leverages malware prevention signatures that are stored in-the-cloud. This solution leverages file reputation and Web reputation technology to detect security risks. The technology works by off loading a large number of malware prevention signatures and lists that were previously stored on endpoints to Trend Micro Smart Protection Server.

Multiple vulnerabilities were found in the Smart Protection Server's Administration UI that would allow a remote unauthenticated attacker to execute arbitrary commands on the system.



## 4. Vulnerable Packages

* Trend Micro Smart Protection Server 3.2 (Build 1085)

Other products and versions might be affected, but they were not tested.



## 5. Vendor Information, Solutions and Workarounds

Trend Micro published the following patches:

* TMSPS3.0 - Critical Patch B1354 ([link](http://downloadcenter.trendmicro.com/index.php?clk=tbl&clkval=4556®s=NABU&lang_loc=1#fragment-4628))
* TMSPS3.1 - Critical Patch B1057 ([link](http://downloadcenter.trendmicro.com/index.php?clk=tbl&clkval=4974®s=NABU&lang_loc=1#fragment-5030))



## 6. Credits

These vulnerabilities were discovered and researched by Leandro Barragan and Maximiliano Vidal from Core Security Consulting Services. The publication of this advisory was coordinated by Alberto Solino from Core Advisories Team.



## 7. Technical Description / Proof of Concept Code

In section 7.1 we describe how an unauthenticated attacker could get a session token to perform authenticated requests against the application.  
Sections 7.2 and 7.3 describe two vectors to achieve remote command execution in the context of the Web application.  
Several public privilege escalation vulnerabilities exist that are still unpatched. In combination with the aforementioned vulnerabilities a remote unauthenticated attacker would be able to execute arbitrary system commands with root privileges.  
Sections 7.4 and 7.5 cover other common Web application vulnerabilities found in the product's console.



### 7.1 Session hijacking via log file disclosure

[[CVE-2017-11398](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-11398)] The application stores diagnostic logs in the /widget/repository/log/diagnostic.log file. Performing a login or some basic browsing will write several entries with the following format:
    

```    
2017-08-18 17:00:38,468,INFO,rti940901j0556161dudhj6805,null,
Notice: Undefined index: param in /var/www/AdminUI/widget/inc/class/common/db/GenericDao.php on line 218
```

              

Each log entry leaks the associated session ID next to the log alert level and can be accessed via HTTP without authenticating to the Web application. Therefore, an unauthenticated attacker can grab this file and hijack active user sessions to perform authenticated requests.



### 7.2 Remote command execution via cron job injection

[[CVE-2017-14094](http://cve.mitre.org/cgi-bin/cvename.cgi?name=2017-14094)] The script admin_update_program.php is responsible for creating a cron job when software updates are scheduled. The HTTP request contains several parameters that are used without sanitization as part of the cron job created at /var/spool/cron/webserv. We will target the hidTimingMin parameter.

File /var/www/AdminUI/php/admin_update_program.php:
    

```    
if ($_SERVER['REQUEST_METHOD'] == 'POST'){
    [...]

    $arr_au['Program']['AUScheduleTimingMin']= isset($_POST["hidTimingMin"])?$_POST["hidTimingMin"]:"0";

    [...]

    if ( $arr_au['Program']['UseAUSchedule'] == "1"){
        if ( $arr_au['Program']['AUScheduleType'] == "0" ){
            $crontab->setDateParams($arr_au['Program']['AUScheduleTimingMin'], $arr_au['Program']['AUScheduleTimingHour'], "*", "*", "*");
        }else {
            $crontab->setDateParams($arr_au['Program']['AUScheduleTimingMin'], $arr_au['Program']['AUScheduleTimingHour'], "*", "*", $arr_au['Program']['AUScheduleTimingDay']);
        }
        $crontab->setCommand("/usr/tmcss/bin/UpdateManage.exe --Program --Schedule > /dev