CVE-2019-9491

Vulnerability

Trend Micro Anti-Threat Toolkit (ATTK) versions 1.62.0.1218 and below contain a vulnerability where the tool will load and execute arbitrary .EXE files if they are named cmd.exe or regedit.exe and placed in the same directory as the ATTK executable. The affected components include attk_collector_cli_x64.exe, TrendMicroRansomwareCollector64.r09.exe, and attk_ScanCleanOnline_gui_x64.exe [1].

Exploitation

An attacker must place a malicious executable named cmd.exe or regedit.exe in the directory where the ATTK is run. When a user launches the ATTK, the tool loads and executes the malicious file without any additional user interaction beyond initiating the scan. Because the ATTK is signed by a verified publisher, any Mark-of-the-Web security warnings are bypassed if the malware was downloaded from the internet [1].

Impact

Successful exploitation allows the attacker to achieve arbitrary remote code execution (RCE) with the privileges of the user running the ATTK. The malicious file runs each time the ATTK is executed, providing a persistence mechanism [1].

Mitigation

Trend Micro has updated the ATTK to version 1.62.0.1223, which addresses this vulnerability. Users should upgrade to the latest version. No workarounds are provided for versions below the fix [1].