CVE-2023-3665: Trellix Endpoint Security RCE Vulnerability

CVE-2023-3665 Overview

CVE-2023-3665 is a code injection vulnerability affecting Trellix Endpoint Security (ENS) 10.7.0 April 2023 release and earlier versions. This vulnerability allows a local user to disable the ENS AMSI (Antimalware Scan Interface) component through manipulation of environment variables, potentially leading to denial of service and execution of arbitrary code on affected systems.

Critical Impact
Local attackers can bypass security controls by disabling the AMSI component, enabling execution of malicious code that would otherwise be detected and blocked by the endpoint security solution.

Affected Products

Trellix Endpoint Security 10.7.0 (April 2023 release and earlier)
Trellix Endpoint Security versions prior to 10.7.0

Discovery Timeline

2023-10-04 - CVE-2023-3665 published to NVD
2024-11-21 - Last updated in NVD database

Technical Details for CVE-2023-3665

Vulnerability Analysis

This vulnerability is classified under CWE-74 (Improper Neutralization of Special Elements in Output Used by a Downstream Component) and CWE-94 (Improper Control of Generation of Code). The vulnerability allows local users to manipulate environment variables that are improperly processed by the Trellix ENS software, resulting in the ability to disable critical security components.

The AMSI component is a critical interface that enables applications and services to integrate with antimalware products. By disabling this component through environment variable manipulation, attackers can effectively blind the endpoint security solution, allowing malicious code to execute without detection.

Root Cause

The root cause stems from improper validation and handling of environment variables within the Trellix ENS application. The software fails to adequately sanitize or restrict user-controlled environment variables before using them in security-critical operations. This allows local users with low privileges to influence the behavior of the AMSI component through carefully crafted environment variable values.

Attack Vector

The attack requires local access to the system with low-privilege user credentials. An attacker would set specific environment variables designed to interfere with the ENS AMSI component's initialization or operation. Once the AMSI component is disabled, the attacker can execute malicious scripts or code that would normally be detected and blocked by the endpoint security solution.

The attack flow typically involves:

A local user identifies the vulnerable environment variable handling in Trellix ENS
The attacker sets malicious environment variables targeting the AMSI component
Upon the next AMSI operation or service restart, the component fails to initialize properly
With AMSI disabled, malicious code can execute without endpoint security intervention

Detection Methods for CVE-2023-3665

Indicators of Compromise

Unexpected modifications to environment variables related to Trellix ENS or AMSI functionality
AMSI component failures or disabled status in Trellix ENS logs
Unusual process behavior following environment variable changes
Security events indicating AMSI bypass attempts

Detection Strategies

Monitor for suspicious environment variable modifications targeting security software
Implement logging for Trellix ENS AMSI component status changes
Deploy endpoint detection rules for AMSI bypass techniques
Review system logs for unexpected security component failures

Monitoring Recommendations

Enable verbose logging for Trellix ENS components to capture AMSI status
Configure SIEM alerts for AMSI-related security events
Implement file integrity monitoring on Trellix ENS configuration files
Monitor for privilege escalation attempts following AMSI component failures

How to Mitigate CVE-2023-3665

Immediate Actions Required

Update Trellix Endpoint Security to the latest version that addresses this vulnerability
Review and restrict user permissions on systems running vulnerable ENS versions
Monitor for signs of exploitation until patches can be applied
Implement application control policies to prevent unauthorized code execution

Patch Information

Trellix has released a security update addressing this vulnerability. Administrators should consult the Trellix Security Advisory SB10405 for detailed patch information and upgrade instructions. Update to Trellix ENS versions released after April 2023 to remediate this vulnerability.

Workarounds

Restrict local user access to systems running Trellix ENS to trusted personnel only
Implement strict environment variable policies through Group Policy or system hardening
Deploy additional monitoring for AMSI component health and status
Consider implementing application whitelisting as a defense-in-depth measure until patching is complete