Affected Version(s)
| Product | Affected Version(s) | Platform | Language(s) |
|---|---|---|---|
| Apex Central | One Premise As a Service (SaaS) | Windows SaaS | English |
Solution
Trend Micro has released the following solutions to address the issue:
| Product | Updated version | Notes | Platform | Availability |
|---|---|---|---|---|
| Apex Central (on-prem) | Patch 3 (Build 6016) | Readme | Windows | Now Available |
| Apex Central (SaaS)* | March 9, 2022, Deployment (Build 6016) | Deployment Notes | SaaS | Already Deployed (March 9) |
These are the minimum recommended version(s) of the patches and/or builds required to address the issue. Trend Micro highly encourages customers to obtain the latest version of the product if there is a newer one available than the one listed in this bulletin.
Customers are encouraged to visit Trend Micro’s Download Center to obtain prerequisite software (such as Service Packs) before applying any of the solutions above.
*Please note that the SaaS version has already been deployed on the backend and no further action is required from SaaS customers on this issue.
Vulnerability Details
CVE-2022-26871: Arbitrary File Upload Remote Code Execution Vulnerability CVSSv3: 8.6: AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:H
An arbitrary file upload vulnerability in Trend Micro Apex Central could allow an unauthenticated remote attacker to upload an arbitrary file which could lead to remote code execution.
Trend Micro Protection
Trend Micro has released the following IPS rules and filters to help protect against exploitation of these vulnerabilities using the following Trend Micro products:
- Trend Micro Cloud One - Workload Security / Deep Security: Rule 1011349 - Trend Micro Apex Central And Control Manager Remote Code Execution Vulnerability (CVE-2022-26871)
- Trend Micro Cloud One - Network Security / TippingPoint: Filter 41072: HTTP: Trend Micro Apex Central Arbitrary File Upload Vulnerability
- Trend Micro Deep Discovery Inspector: Rule 4673: CVE-2022-26871_HTTP_REMOTE_CODE_EXECUTION_EXPLOIT
Mitigating Factors
Exploiting these type of vulnerabilities generally require that an attacker has access (physical or remote) to a vulnerable machine. In addition to timely application of patches and updated solutions, customers are also advised to review remote access to critical systems and ensure policies and perimeter security is up-to-date.
However, even though an exploit may require several specific conditions to be met, Trend Micro strongly encourages customers to update to the latest builds as soon as possible.
Acknowledgement
Trend Micro would like to thank the following individuals for responsibly disclosing these issues and working with Trend Micro to help protect our customers:
- Trend Micro Research