Published: 12/04/2017 Updated: 17/04/2017

CVSS v2 Base Score: 10 | Impact Score: 10 | Exploitability Score: 10

CVSS v3 Base Score: 9.8 | Impact Score: 5.9 | Exploitability Score: 3.9

VMScore: 1000

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

On the Trend Micro Threat Discovery Appliance 2.6.1062r1, directory traversal when processing a session_id cookie allows a remote, unauthenticated malicious user to delete arbitrary files as root. This can be used to bypass authentication or cause a DoS.

Vulnerable Product	Search on Vulmon	Subscribe to Product
trendmicro threat discovery appliance 2.6.1062

Trend Micro Threat Discovery Appliance versions 261062r1 and below suffer from a log_query_daecgi remote code execution vulnerability ...

Trend Micro Threat Discovery Appliance versions 261062r1 and below suffer from a log_query_dlpcgi remote code execution vulnerability ...

This Metasploit module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance The first is an authentication bypass vulnerability via a file delete in logoffcgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552) The second is a cmd injection flaw using the timezone parameter in the admin_sys_timecgi i ...

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance The first is an authentication bypass vulnerability via a file delete in logoffcgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552) The second is a cmdi flaw using the timezone parameter in the admin_sys_ ...

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552). The second is a cmdi flaw using the timezone parameter in the admin_sys_time.cgi interface (CVE-2016-7547). Note: You have the option to use the authentication bypass or not since it requires that the server is rebooted. The password reset will render the authentication useless. Typically, if an administrator cant login, they will bounce the box. Therefore, this module performs a heartbeat request until the box is bounced and then attempts to login and to perform the command injection. This module has been tested on version 2.6.1062r1 of the appliance.

msf > use exploit/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > show targets
    ...targets...
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > set TARGET < target-id >
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > show options
    ...show and set options...
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > exploit

This module exploits two vulnerabilities the Trend Micro Threat Discovery Appliance. The first is an authentication bypass vulnerability via a file delete in logoff.cgi which resets the admin password back to 'admin' upon a reboot (CVE-2016-7552). The second is a cmdi flaw using the timezone parameter in the admin_sys_time.cgi interface (CVE-2016-7547). Note: You have the option to use the authentication bypass or not since it requires that the server is rebooted. The password reset will render the authentication useless. Typically, if an administrator cant login, they will bounce the box. Therefore, this module performs a heartbeat request until the box is bounced and then attempts to login and to perform the command injection. This module has been tested on version 2.6.1062r1 of the appliance.

msf > use exploit/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > show targets
    ...targets...
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > set TARGET < target-id >
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > show options
    ...show and set options...
msf exploit(trendmicro_threat_discovery_admin_sys_time_cmdi) > exploit

CWE-22 https://github.com/rapid7/metasploit-framework/pull/8216/commits/0f07875a2ddb0bfbb4e985ab074e9fc56da1dcf6 http://www.securityfocus.com/bid/97599 https://nvd.nist.gov https://packetstormsecurity.com/files/142219/Trend-Micro-Threat-Discovery-Appliance-2.6.1062r1-log_query_dae.cgi-Remote-Code-Execution.html https://www.rapid7.com/db/modules/exploit/multi/http/trendmicro_threat_discovery_admin_sys_time_cmdi

CVE-2016-7552

Vulnerability Summary

Vulnerability Trend

Exploits

Metasploit Modules

References

Vulmon Search

About

Products

Connect