CVE-2024-52047: Trend Micro Apex One RCE Vulnerability

CVE-2024-52047 Overview

CVE-2024-52047 is a local file inclusion (LFI) vulnerability in the widget component of Trend Micro Apex One. A remote attacker who already holds low-privileged code execution on the target system can leverage the flaw to execute arbitrary code on affected installations. The weakness is tracked under CWE-552: Files or Directories Accessible to External Parties and affects both the on-premises and SaaS distributions of the product. Trend Micro has published a corresponding advisory and fix.

Critical Impact
Successful exploitation results in arbitrary code execution on the Apex One server, giving attackers a pivot point across managed endpoints.

Affected Products

Trend Micro Apex One 2019 (on-premises, Windows)
Trend Micro Apex One as a Service (SaaS)
Apex One widget framework component

Discovery Timeline

2024-12-31 - CVE-2024-52047 published to the National Vulnerability Database (NVD)
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-52047

Vulnerability Analysis

The vulnerability resides in the Apex One widget framework, a web-based component used to render management dashboards. The widget code accepts attacker-influenced input that is used to reference a file path without adequate validation. This allows an authenticated user to coerce the application into including a file the attacker controls or has placed on the system. Because the widget executes server-side code, file inclusion translates directly into arbitrary code execution in the context of the Apex One server process.

Exploitation requires prior low-privileged code execution on the target, but the attack vector is network-based and requires no user interaction. The impact spans confidentiality, integrity, and availability, since Apex One runs with elevated privileges and controls endpoint agents across the environment.

Root Cause

The root cause is insufficient sanitization of file path parameters supplied to widget handlers. The framework trusts inputs that reference server-side resources, permitting inclusion of files outside the expected widget directory. [CWE-552] describes this class of exposure where files or directories become reachable to unauthorized parties.

Attack Vector

An attacker with a foothold that permits low-privileged code execution issues crafted requests to the Apex One management interface. The request coerces the widget loader into including an attacker-supplied file. Once loaded, the file executes with the privileges of the Apex One service, enabling lateral movement to managed endpoints and modification of security policies.

See the Trend Micro Support Solution KA-0016669 for the vendor's technical description.

Detection Methods for CVE-2024-52047

Indicators of Compromise

Unexpected files written to Apex One widget directories such as PCCSRV\web\widget on the management server.
HTTP requests to widget endpoints containing path traversal sequences (..\, ../, encoded variants) or absolute file paths.
New child processes spawned by the Apex One IIS worker or management service that do not match baseline activity.

Detection Strategies

Inspect Apex One web server access logs for widget URLs carrying suspicious file path parameters or references to non-widget file extensions.
Correlate low-privilege code execution alerts on the Apex One server host with subsequent HTTP activity against the management console.
Baseline the set of files loaded by the widget framework and alert on deviations, particularly newly created .php, .asp, or script files inside widget paths.

Monitoring Recommendations

Enable verbose auditing on the Apex One server file system, focusing on writes into web-accessible directories.
Forward Apex One server logs and Windows Security event logs to a centralized SIEM for correlation with authentication and process telemetry.
Monitor outbound connections from the Apex One server, since post-exploitation typically initiates command-and-control or lateral movement traffic.

How to Mitigate CVE-2024-52047

Immediate Actions Required

Apply the fixed build referenced in Trend Micro Support Solution KA-0016669 to all Apex One on-premises servers.
Verify that SaaS tenants are running the patched service version and confirm with Trend Micro if uncertain.
Rotate credentials for accounts with access to the Apex One management console and audit recent administrative activity.

Patch Information

Trend Micro has released an updated Apex One build that corrects the widget file inclusion behavior. Administrators should install the update documented in the vendor's KA-0016669 advisory. SaaS customers receive the fix automatically through the vendor's update channel. On-premises Apex One 2019 deployments on Windows must be patched manually.

Workarounds

Restrict network access to the Apex One management console so that only administrative subnets can reach the widget endpoints.
Enforce least-privilege access on the Apex One server host to reduce the likelihood of an attacker obtaining the low-privileged execution prerequisite.
Remove or disable local accounts on the Apex One server that are not required for operation.

bash

# Configuration example: restrict Apex One console access with Windows Firewall
netsh advfirewall firewall add rule name="ApexOne-Console-Allow-AdminSubnet" ^
  dir=in action=allow protocol=TCP localport=4343 remoteip=10.10.20.0/24
netsh advfirewall firewall add rule name="ApexOne-Console-Block-Other" ^
  dir=in action=block protocol=TCP localport=4343