CVE-2023-3665: Trellix Endpoint Security RCE Vulnerability

CVE-2023-3665 Overview

CVE-2023-3665 is a code injection vulnerability affecting Trellix Endpoint Security (ENS) 10.7.0 April 2023 release and earlier versions. This vulnerability allows a local user to disable the ENS AMSI (Antimalware Scan Interface) component through manipulation of environment variables, potentially leading to denial of service and execution of arbitrary code on affected systems.

Critical Impact

Local attackers can bypass security controls by disabling the AMSI component, enabling execution of malicious code that would otherwise be detected and blocked by the endpoint security solution.

Affected Products

• Trellix Endpoint Security 10.7.0 (April 2023 release and earlier)
• Trellix Endpoint Security versions prior to 10.7.0

Discovery Timeline

• 2023-10-04 - CVE-2023-3665 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-3665

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-94 (Improper Control of Generation of Code). The vulnerability allows local users to manipulate environment variables that are improperly processed by the Trellix ENS software, resulting in the ability to disable critical security components.

The AMSI component is a critical interface that enables applications and services to integrate with antimalware products. By disabling this component through environment variable manipulation, attackers can effectively blind the endpoint security solution, allowing malicious code to execute without detection.

Root Cause

The root cause stems from improper validation and handling of environment variables within the Trellix ENS application. The software fails to adequately sanitize or restrict user-controlled environment variables before using them in security-critical operations. This allows local users with low privileges to influence the behavior of the AMSI component through carefully crafted environment variable values.

Attack Vector

The attack requires local access to the system with low-privilege user credentials. An attacker would set specific environment variables designed to interfere with the ENS AMSI component's initialization or operation. Once the AMSI component is disabled, the attacker can execute malicious scripts or code that would normally be detected and blocked by the endpoint security solution.

The attack flow typically involves:

1. A local user identifies the vulnerable environment variable handling in Trellix ENS
2. The attacker sets malicious environment variables targeting the AMSI component
3. Upon the next AMSI operation or service restart, the component fails to initialize properly
4. With AMSI disabled, malicious code can execute without endpoint security intervention

Detection Methods for CVE-2023-3665

Indicators of Compromise

• Unexpected modifications to environment variables related to Trellix ENS or AMSI functionality
• AMSI component failures or disabled status in Trellix ENS logs
• Unusual process behavior following environment variable changes
• Security events indicating AMSI bypass attempts

Detection Strategies

• Monitor for suspicious environment variable modifications targeting security software
• Implement logging for Trellix ENS AMSI component status changes
• Deploy endpoint detection rules for AMSI bypass techniques
• Review system logs for unexpected security component failures

Monitoring Recommendations

• Enable verbose logging for Trellix ENS components to capture AMSI status
• Configure SIEM alerts for AMSI-related security events
• Implement file integrity monitoring on Trellix ENS configuration files
• Monitor for privilege escalation attempts following AMSI component failures

How to Mitigate CVE-2023-3665

Immediate Actions Required

• Update Trellix Endpoint Security to the latest version that addresses this vulnerability
• Review and restrict user permissions on systems running vulnerable ENS versions
• Monitor for signs of exploitation until patches can be applied
• Implement application control policies to prevent unauthorized code execution

Patch Information

Trellix has released a security update addressing this vulnerability. Administrators should consult the Trellix Security Advisory SB10405 for detailed patch information and upgrade instructions. Update to Trellix ENS versions released after April 2023 to remediate this vulnerability.

Workarounds

• Restrict local user access to systems running Trellix ENS to trusted personnel only
• Implement strict environment variable policies through Group Policy or system hardening
• Deploy additional monitoring for AMSI component health and status
• Consider implementing application whitelisting as a defense-in-depth measure until patching is complete