CVE-2021-32463
📋 TL;DR
This vulnerability allows a local attacker with low-privileged access to escalate privileges and delete files with system-level permissions on Trend Micro security products. It affects Trend Micro Apex One, Apex One as a Service, Worry-Free Business Security 10.0 SP1, and Worry-Free Services. Attackers must already have code execution capability on the target system to exploit this.
💻 Affected Systems
- Trend Micro Apex One
- Trend Micro Apex One as a Service
- Trend Micro Worry-Free Business Security 10.0 SP1
- Trend Micro Worry-Free Services
📦 What is this software?
Apex One by Trendmicro
⚠️ Risk & Real-World Impact
Worst Case
Complete system compromise through privilege escalation leading to arbitrary file deletion, service disruption, and potential installation of persistent malware.
Likely Case
Local privilege escalation allowing attackers to delete critical system files, disrupt security services, and maintain persistence on compromised systems.
If Mitigated
Limited impact if proper access controls and monitoring are in place, though local privilege escalation remains possible.
🎯 Exploit Status
Exploitation requires existing low-privileged access. The vulnerability is in permission assignment logic, making exploitation straightforward once initial access is obtained.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Apex One 2019 (Build 11180) and later, Worry-Free Business Security 10.0 SP1 Patch 1 (Build 3001) and later
Vendor Advisory: https://success.trendmicro.com/solution/000286855
Restart Required: Yes
Instructions:
1. Download the latest security patch from Trend Micro support portal. 2. Apply the patch to all affected systems. 3. Restart the Trend Micro services or the entire system as required. 4. Verify the patch installation through the management console.
🔧 Temporary Workarounds
Restrict local access
windowsLimit local user access to systems running Trend Micro software to trusted administrators only
Monitor file deletion events
windowsEnable auditing for file deletion events in Windows Event Logs to detect suspicious activity
auditpol /set /subcategory:"File System" /success:enable /failure:enable
🧯 If You Can't Patch
- Implement strict access controls to prevent unauthorized local access to affected systems
- Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts
🔍 How to Verify
Check if Vulnerable:
Check Trend Micro product version in the management console or via 'tmcmd --version' command. Compare against patched versions.Check Version:
tmcmd --versionVerify Fix Applied:
Verify the installed version is equal to or higher than the patched versions listed in the vendor advisory.📡 Detection & Monitoring
Log Indicators:
- Unexpected file deletion events in Windows Security logs (Event ID 4663)
- Privilege escalation attempts in Trend Micro logs
- Unusual service restarts or failures
Network Indicators:
- Unusual outbound connections from Trend Micro services
- Lateral movement attempts from affected systems
SIEM Query:
EventID=4663 AND ObjectType="File" AND AccessMask="0x10000" AND ProcessName contains "Trend Micro"🔗 References
- https://success.trendmicro.com/solution/000286855
- https://success.trendmicro.com/solution/000286856
- https://www.zerodayinitiative.com/advisories/ZDI-21-786/
- https://success.trendmicro.com/solution/000286855
- https://success.trendmicro.com/solution/000286856
- https://www.zerodayinitiative.com/advisories/ZDI-21-786/
