CVE-2017-14097

published 2018-01-19

CVE-2017-14097: An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents…

Priority P2 68 critical 9.8 CVSS 3.0

AV N AC L PR N UI N S U C H I H A H

EXPLOIT

An improper access control vulnerability in Trend Micro Smart Protection Server (Standalone) versions 3.2 and below could allow an attacker to decrypt contents of a database with information that could be used to access a vulnerable system.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
trend_micro	trend_micro_smart_protection_server	—	—
trendmicro	smart_protection_server	<= 3.2	—

Detection & IOCs extracted from sources · hover to see the quote

path /widget/repository/log/diagnostic.log↗

path /var/www/AdminUI/widget/repository/log/diagnostic.log↗

path /var/spool/cron/webserv↗

path /var/www/AdminUI/php/admin_update_program.php↗

path /var/www/AdminUI/php/inc/crontab.php↗

path /widget/inc/widget_package_manager.php↗

url https://<host>:<port>/widget/repository/log/diagnostic.log↗

url https://<host>:<port>/php/admin_update_program.php?sid=<session_id>↗

port 4343↗

process /usr/tmcss/bin/UpdateManage.exe --Program --Schedule > /dev/null 2>&1↗

• → Monitor unauthenticated HTTP GET requests to /widget/repository/log/diagnostic.log — this is the session-hijacking vector used to harvest active session IDs without credentials. ↗
• → Detect POST requests to /php/admin_update_program.php where the hidTimingMin parameter contains shell metacharacters or cron-injection patterns (e.g., '* * * * *' followed by a command and '#'). ↗
• → Alert on modifications to /var/spool/cron/webserv that contain unexpected commands beyond the legitimate UpdateManage.exe entry — indicates successful cron job injection. ↗
• → Detect POST requests to /php/admin_update_program.php that include the response string 'MSG_UPDATE_UPDATE_SCHEDULE' in the reply, confirming successful cron injection by the exploit. ↗
• → Monitor for LFI attempts against /widget/inc/widget_package_manager.php with user-controlled input passed to PHP require_once — the application appends 'PoolManager.php' to the filename. ↗
• → Correlate unauthenticated access to diagnostic.log followed shortly by authenticated POST to admin_update_program.php from the same source IP — this is the full session-hijack-to-RCE attack chain. ↗

• · The improper access control (CVE-2017-14097) allows decryption of database contents; the database credential/key material is accessible to unauthenticated users, meaning network-level access controls to the Admin UI are the primary mitigation until patching. ↗
• · Only Trend Micro Smart Protection Server 3.2 (Build 1085) was confirmed tested; other versions may also be affected but were not validated. ↗

CVSS provenance

nvd v3.0 9.8 CRITICAL CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvd v2.0 5.0 MEDIUM AV:N/AC:L/Au:N/C:P/I:N/A:N

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.