CVE-2019-8385: An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the…

PriorityP274critical9.8CVSS 3.0

AVNACLPRNUINSUCHIHAH

EXPLOIT

EPSS

19.64%

97.1th percentile

An issue was discovered in Thomson Reuters Desktop Extensions 1.9.0.358. An unauthenticated directory traversal and local file inclusion vulnerability in the ThomsonReuters.Desktop.Service.exe and ThomsonReuters.Desktop.exe allows a remote attacker to list or enumerate sensitive contents of files via a \.. to port 6677. Additionally, this could allow for privilege escalation by dumping the affected machine's SAM and SYSTEM database files, as well as remote code execution.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
thomsonreuters	concourse_matter_room	< 2.13.0098	2.13.0098
thomsonreuters	firm_central_desktop	< 2.13.0098	2.13.0098

Detection & IOCsextracted from sources · hover to see the quote

port6677↗

port7000↗

port7001↗

port7002↗

processThomsonReuters.Desktop.Service.exe↗

→Flag HTTP responses on port 6677 (or 7000-7002) containing the string 'Page Not FoundSorry, we couldn't find what you were looking for' as an indicator that the vulnerable Thomson Reuters Desktop Extensions service is exposed. ↗
→Monitor for attempts to access sensitive Windows files (SAM, SYSTEM database) via traversal paths served through the Thomson Reuters Desktop Extensions HTTP service, which could indicate privilege escalation attempts. ↗
→Ensure traversal payloads in HTTP requests are not URL-encoded or base64-encoded; detection rules should account for raw backslash sequences in the request path. ↗

·The service may not always listen on the default port 6677; it has also been observed on ports 7000–7002, so detection and scanning must cover all four ports. ↗
·The error message used as a vulnerability fingerprint ('Page Not FoundSorry, we couldn't find what you were looking for') may be disabled or customized on some deployments, causing false negatives in detection. ↗

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

nvdv2.07.5HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.