CVE-2024-46902: Trend Micro DDI Information Disclosure

CVE-2024-46902 Overview

CVE-2024-46902 is a SQL injection vulnerability [CWE-89] in Trend Micro Deep Discovery Inspector (DDI) versions 5.8 and above. An authenticated attacker with administrative privileges can exploit the flaw to disclose sensitive information from affected installations. The issue carries a CVSS 3.1 base score of 9.1 with a scope change, reflecting the potential to impact components beyond the vulnerable application. Trend Micro published a fix referenced in solution KA-0017793, and the Zero Day Initiative tracks the issue as ZDI-24-1227.

Critical Impact

An authenticated administrator can leverage SQL injection in Deep Discovery Inspector to access sensitive data and pivot across security boundaries, compromising confidentiality, integrity, and availability.

Affected Products

• Trend Micro Deep Discovery Inspector 5.8 and above
• Trend Micro Deep Discovery Inspector 6.6 (builds 1078, 1080)
• Trend Micro Deep Discovery Inspector 6.7 (builds 1077, 1086)

Discovery Timeline

• 2024-10-22 - CVE-2024-46902 published to the National Vulnerability Database
• 2024-10-22 - Trend Micro publishes solution KA-0017793
• 2024-10-22 - Zero Day Initiative releases advisory ZDI-24-1227
• 2024-10-25 - Last updated in NVD database

Technical Details for CVE-2024-46902

Vulnerability Analysis

The vulnerability is a SQL injection flaw [CWE-89] in Deep Discovery Inspector, a network traffic analysis appliance. Attacker-supplied input reaches a database query without proper sanitization or parameterization. An authenticated administrator can manipulate query logic to read data that the application would not otherwise return. The flaw has network attack reachability and runs with a scope change, meaning a successful exploit can affect resources beyond the vulnerable component. Trend Micro classifies the outcome as sensitive information disclosure, while the CVSS impact metrics also flag integrity and availability consequences. Exploitation requires no user interaction once administrative access is obtained.

Root Cause

The underlying defect is improper neutralization of special elements used in an SQL command. The application concatenates or interpolates parameters into a query rather than binding them as typed values. An attacker who controls a vulnerable parameter can inject clauses such as UNION SELECT or boolean predicates to enumerate database content. The fix detailed in solution KA-0017793 constrains how these inputs are processed before reaching the database engine.

Attack Vector

Exploitation requires prior administrative access to the Deep Discovery Inspector management interface. The attacker authenticates as a high-privileged user, then issues a crafted request to a vulnerable endpoint that performs database queries. The injected payload alters the executed SQL, allowing extraction of stored records, configuration data, or credentials. Because Deep Discovery Inspector aggregates security telemetry, disclosed data can include sensor logs, captured indicators, and account material. The scope-change rating indicates the impact can extend to other authorization scopes managed by the appliance. Refer to the ZDI Security Advisory ZDI-24-1227 for additional technical context.

No public proof-of-concept exploit is available, and the issue is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-46902

Indicators of Compromise

• Authenticated administrator sessions issuing requests containing SQL meta-characters such as ', --, UNION, or SLEEP( against Deep Discovery Inspector management endpoints.
• Unexpected database errors, query timeouts, or anomalous response sizes returned by the DDI web interface.
• Administrative logins from new or atypical source addresses immediately preceding bulk data export activity.

Detection Strategies

• Inspect DDI web access logs for parameter values that contain SQL syntax tokens and correlate them with the originating account.
• Alert on administrative API calls that return unusually large payloads or that occur outside maintenance windows.
• Compare appliance audit trails against change-management records to identify unauthorized administrative activity.

Monitoring Recommendations

• Forward DDI authentication, audit, and web server logs to a centralized SIEM for correlation with identity telemetry.
• Track administrative account usage and flag sessions that deviate from established baselines for time, source, or volume.
• Enable database query logging where supported and alert on queries that include union operators or stacked statements.

How to Mitigate CVE-2024-46902

Immediate Actions Required

• Apply the Trend Micro fix described in Trend Micro Solution KA-0017793 to all Deep Discovery Inspector appliances running 5.8 or later.
• Audit Deep Discovery Inspector administrator accounts and revoke unused or shared credentials.
• Restrict management interface access to a hardened administrative network or jump host.
• Rotate credentials and API keys stored on or accessible from the appliance after patching.

Patch Information

Trend Micro has issued a security update for Deep Discovery Inspector. Refer to the vendor advisory at Trend Micro Solution KA-0017793 for fixed build numbers and upgrade procedures. The Zero Day Initiative advisory ZDI-24-1227 provides additional disclosure details.

Workarounds

• Enforce multi-factor authentication for all DDI administrator accounts to reduce the risk of credential abuse that precedes exploitation.
• Limit network reachability of the DDI management interface using firewall rules or VPN segmentation until patches are applied.
• Monitor and alert on administrative session activity, especially queries that return large datasets or access sensitive tables.