Security solutions provider Trend Micro has released security updates for a zero-day vulnerability found in its Apex One and Apex One SaaS endpoint security solutions. Threat actors are known to be actively exploiting it.
The security vulnerability with code CVE-2022-40139 comes from incorrect input validation in the application’s Rollback function. An authenticated remote user with access to the Admin console could exploit it to force Agents to download unverified malicious Rollback components.
Trend Micro also fixed several medium-risk security issues (CVE-2022-40141, CVE-2022-40144) along with CVE-2022-40139. The first (CVE-2022-40141) lets threat actors reach sensitive data. The second (CVE-2022-40144) lets remote threat actors bypass authentication checks and gain unauthorized access to the application.
Users of Trend Micro Apex One and Apex One SaaS 2019 versions should apply the published updates right away. This keeps them from becoming the target of attacks that use these vulnerabilities.
What did Trend Micro publish?
Trend Micro’s September 2022 security bulletin for Apex One was released on 13 September 2022. It covers Apex One 2019 (on-premises) and Apex One as a Service (SaaS) on Windows. The bulletin lists six vulnerabilities, CVE-2022-40139 to CVE-2022-40144, with CVSS 3.0 scores from 5.5 to 8.2. Trend Micro says it has seen at least one active attempt to exploit CVE-2022-40139 in the wild.
Which flaws matter most?
- CVE-2022-40139 (7.2): The rollback mechanism does not properly check its components. A server administrator, or an attacker with access to the Apex One server console, could tell agents to download an unverified rollback package. That can lead to remote code execution.
- CVE-2022-40144 (8.2): A login authentication bypass. An attacker fakes request parameters to get in.
- CVE-2022-40141 (5.6): An information disclosure flaw. An attacker who intercepts communication strings can decode details that identify an Apex One server.
- CVE-2022-40142 (7.8) and CVE-2022-40143 (7.3): Link-following flaws in the agent and the server. They let a low-privileged user gain higher privileges or run code.
- CVE-2022-40140 (5.5): An origin validation error that lets a local attacker cause a denial of service.
Note that the exploited flaw needs access to the Admin console. That limits who can attack it, but it also makes the console a more valuable target. Stolen admin credentials or an exposed console would be enough.
How do you fix it?
Trend Micro lists the fixed builds. For on-premises installs, apply Apex One Service Pack 1. For the SaaS version, the August 2022 monthly patch (202208, agent version 14.0.11676) has the fix. Trend Micro advises customers to move to the latest build. As a safeguard, keep the Apex One management console off the open internet and limit it to administrator networks. Turn on multi-factor authentication for admin accounts where the product allows it, and review recent console logins.