CVE-2019-8385
📋 TL;DR
CVE-2019-8385 is an unauthenticated directory traversal and local file inclusion vulnerability in Thomson Reuters Desktop Extensions. It allows remote attackers to read sensitive files, potentially leading to privilege escalation and remote code execution. Organizations using affected versions of Thomson Reuters Desktop Extensions are at risk.
💻 Affected Systems
- Thomson Reuters Desktop Extensions
📦 What is this software?
Concourse Matter Room by Thomsonreuters
Firm Central Desktop by Thomsonreuters
⚠️ Risk & Real-World Impact
Worst Case
Remote code execution leading to full system compromise, credential theft via SAM/SYSTEM database dumping, and lateral movement within the network.
Likely Case
Unauthenticated attackers reading sensitive files, potentially exposing credentials, configuration files, and other confidential data.
If Mitigated
Limited impact with proper network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Exploitation requires only network access to port 6677 and uses simple directory traversal sequences.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Version after 1.9.0.358
Vendor Advisory: https://www.thomsonreuters.com/en/products-services.html
Restart Required: Yes
Instructions:
1. Contact Thomson Reuters support for updated version. 2. Download and install the patched version. 3. Restart affected services and systems.
🔧 Temporary Workarounds
Block Port 6677
windowsBlock inbound traffic to port 6677 at network perimeter and internally where possible.
netsh advfirewall firewall add rule name="Block TR Port 6677" dir=in action=block protocol=TCP localport=6677
Restrict Service Access
windowsConfigure Windows Firewall to restrict access to Thomson Reuters services to trusted IPs only.
netsh advfirewall firewall add rule name="Restrict TR Service" dir=in action=allow protocol=TCP localport=6677 remoteip=192.168.1.0/24
🧯 If You Can't Patch
- Implement strict network segmentation to isolate affected systems from untrusted networks.
- Deploy application control solutions to prevent unauthorized execution of Thomson Reuters binaries.
🔍 How to Verify
Check if Vulnerable:
Check if ThomsonReuters.Desktop.Service.exe or ThomsonReuters.Desktop.exe version 1.9.0.358 is running and listening on port 6677.Check Version:
wmic product where "name like 'Thomson Reuters%'" get versionVerify Fix Applied:
Verify the software version is updated beyond 1.9.0.358 and test directory traversal attempts are blocked.📡 Detection & Monitoring
Log Indicators:
- Unusual access patterns to port 6677
- Failed directory traversal attempts in application logs
- Multiple requests with '..' sequences
Network Indicators:
- Unusual traffic to port 6677 from untrusted sources
- HTTP-like requests containing '..' patterns
SIEM Query:
source_port=6677 AND (uri="*..*" OR user_agent="*..*")🔗 References
- http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html
- https://www.thomsonreuters.com/en/products-services.html
- http://packetstormsecurity.com/files/152298/Thomson-Reuters-Concourse-And-Firm-Central-Local-File-Inclusion-Directory-Traversal.html
- https://www.thomsonreuters.com/en/products-services.html
