Exploit-DB #44166
Description: Trend Micro Email Encryption Gateway 5.5 (Build 1111.00) - Multiple Vulnerabilities
Type: webapps
Platform: jsp
Date: 2018-02-22
Author: Core Security

Exploit:
Core Security - Corelabs Advisory
http://corelabs.coresecurity.com/

Trend Micro Email Encryption Gateway Multiple Vulnerabilities

1. *Advisory Information*

Title: Trend Micro Email Encryption Gateway Multiple Vulnerabilities
Advisory ID: CORE-2017-0006
Advisory URL:
http://www.coresecurity.com/advisories/trend-micro-email-encryption-gateway-multiple-vulnerabilities
Date published: 2018-02-21
Date of last update: 2018-02-21
Vendors contacted: Trend Micro
Release mode: Coordinated release

2. *Vulnerability Information*

Class: Cleartext Transmission of Sensitive Information [CWE-319],
External Control of File Name or Path [CWE-73], Insufficient
Verification of Data Authenticity [CWE-345], External Control of File
Name or Path [CWE-73], Missing Authentication for Critical Function
[CWE-306], Cross-Site Request Forgery [CWE-352], Improper Restriction of
XML External Entity Reference [CWE-611], Improper Neutralization of
Input During Web Page Generation ('Cross-site Scripting') [CWE-79],
Improper Neutralization of Input During Web Page Generation ('Cross-site
Scripting') [CWE-79], Improper Neutralization of Input During Web Page
Generation ('Cross-site Scripting') [CWE-79], Improper Neutralization of
Special Elements used in an SQL Command [CWE-89], Improper
Neutralization of Special Elements used in an SQL Command [CWE-89],
Improper Neutralization of Special Elements used in an SQL Command
[CWE-89]
Impact: Code execution
Remotely Exploitable: Yes
Locally Exploitable: Yes
CVE Name: CVE-2018-6219, CVE-2018-6220, CVE-2018-6221, CVE-2018-6222,
CVE-2018-6223, CVE-2018-6224, CVE-2018-6225, CVE-2018-6226,
CVE-2018-6226, CVE-2018-6227, CVE-2018-6228, CVE-2018-6229, CVE-2018-6230

3. *Vulnerability Description*

Trend Micro's website states that:[1]
     
Encryption for Email Gateway is a Linux-based software solution providing
the ability to perform the encryption and decryption of email at the
corporate gateway, regardless of the email client, and the platform from
which it originated. The encryption and decryption of email on the TMEEG
client is controlled by a Policy Manager that enables an administrator
to configure policies based on various parameters, such as sender and
recipient email addresses, keywords, or PCI compliance. Encryption for
Email Gateway presents itself as an SMTP interface and delivers email
out over an SMTP to configured outbound MTAs. This enables easy
integration with other email server-based products, be them content
scanners, mail servers, or archiving solutions."
     
Multiple vulnerabilities were found in the Trend Micro Email Encryption
Gateway web console that would allow a remote unauthenticated attacker
to gain command execution as root.

We also present two additional vectors to achieve code execution from a
man-in-the-middle position.
     
4. *Vulnerable Packages*

. Trend Micro Email Encryption Gateway 5.5 (Build 1111.00)
Other products and versions might be affected, but they were not tested.

5. *Vendor Information, Solutions and Workarounds*

Trend Micro published the following Security Notes:

.
https://success.trendmicro.com/solution/1119349-security-bulletin-trend-micro-email-encryption-gateway-5-5-multiple-vulnerabilities

6. *Credits*

These vulnerabilities were discovered and researched by Leandro Barragan
and Maximiliano Vidal from Core Security Consulting Services. The
publication of this advisory was coordinated by Alberto Solino from Core
Advisories Team.
   
7. *Technical Description / Proof of Concept Code*

Trend Micro Email Encryption Gateway includes a web console to perform
administrative tasks. Section 7.4 describes a vulnerability in this
console that can be exploited to gain command execution as root. The
vulnerable functionality is accessible only to authenticated users, but
it is possible to combine 7.4 with the vulnerability presented in
section 7.5 to bypass this restriction and therefore execute root
commands from the perspective of a remote unauthenticated attacker.
     
The application does also use an insecure update mechanism that allows
an attacker in a man-in-the-middle position to write arbitrary files and
install arbitrary RPM packages, leading to remote command execution as
the root user.
     
Additional Web application vulnerabilities were found, including
cross-site request forgery (7.6), XML external entity injection (7.7),
several cross-site scripting vulnerabilities (7.8, 7.9, 7.10), and SQL
injection vulnerabilities (7.11, 7.12, 7.13).
     
7.1. *Insecure update via HTTP*

[CVE-2018-6219]
Communication to the update servers is unencrypted. The following URL is
fetched when the application checks for updates:
         
/-----
[Request #1]
 http://downloads.privatepost.com/files/TMEEG/updates/data.html
-----/

The product expects to retrieve a plain-text file with the following
format:

/-----
[Version Info]
[Installation RPM file name]
[Path to release notes]
-----/

If a new update is found, then the RPM file is downloaded from the
following URL:

/-----
[Request #2]
http://downloads.privatepost.com/files/TMEEG/updates/[Installation RPM
file name]
-----/

This means that the product does not do any kind of certificate
validation or public key pinning, which makes it easier for an attacker
to eavesdrop and tamper the data.

7.2. *Arbitrary file write leading to command execution*

[CVE-2018-6220]
The following code snippet is responsible for downloading the update
file (com/identum/pmg/web/CheckForUpdates.java):
         
/-----
FileDownload fd = new FileDownload();
if (!fd.download(updateURLRoot + "/" + rpmFileName, "/tmp/" +
rpmFileName)) {
    return 10;
}
[...]
-----/

The rpmFileName variable is controlled by the attacker, as it is taken
from the aforementioned update file. As a consequence, the attacker
controls the path where the update file is going to be do