CVE-2023-34144

Vulnerability

An untrusted search path vulnerability exists in the Trend Micro Apex One and Apex One as a Service security agent, specifically within the Apex One Client Plug-in Service Manager. The issue arises when the service loads a module from an untrusted location, allowing an attacker to control the loaded module. Affected versions include Apex One 2019 (On-prem) and Apex One as a Service versions before the May 2023 Maintenance [1][2].

Exploitation

To exploit this vulnerability, an attacker must first obtain the ability to execute low-privileged code on the target system. Once achieved, the attacker can leverage the untrusted search path by placing a malicious module in a location that the service will load, thereby triggering the vulnerability [1].

Impact

Successful exploitation allows the attacker to escalate privileges and execute arbitrary code in the context of the SYSTEM account, leading to full compromise of the affected system [1].

Mitigation

Trend Micro has released updates to address this vulnerability: for Apex One (On-prem), apply Service Pack 1 Critical Patch B12033; for Apex One as a Service, apply the May 2023 Maintenance (Hotfix Build 202305, Security Agent version 14.0.12518) [2]. No workarounds have been provided.