CVE-2019-20358

Vulnerability

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below contain a vulnerability that may allow an attacker to place malicious files in the same directory as the tool. When the tool is executed, the malicious file may also execute, leading to arbitrary remote code execution (RCE). This is similar to CVE-2019-9491, and was resolved in version 1.62.0.1228 [1].

Exploitation

The attacker needs to have the ability to place a malicious file in the directory where the user will run the ATTK tool. This could be achieved through social engineering or by leveraging another vulnerability to write a file. No user interaction beyond running the tool is required for the payload to execute. The attack vector relies on the tool loading or executing resources from its own directory, which the attacker has compromised.

Impact

Successful exploitation allows the attacker to achieve arbitrary remote code execution (RCE) on the affected system. The attacker gains the ability to execute code within the security context of the user running the ATTK tool, potentially leading to full compromise of the system and data.

Mitigation

Trend Micro released version 1.62.0.1228 of ATTK to address this vulnerability. Users should update to this fixed version or later. No workarounds are documented. The vulnerability is not listed on the CISA KEV catalog as of the published date. [1]