CVE-2023-0587

What it actually does

The vulnerability allows an unauthenticated remote attacker to send a crafted HTTP PUT request with a malformed Content-Length header to the Apex One server endpoint /officescan/console/html/cgi/fcgiOfcDDA.exe. Because the server does not properly validate the request, the attacker can write arbitrary files into the Apex One SampleSubmission directory, commonly under \PCCSRV\TEMP\SampleSubmission. The primary technical effects are unauthorized file creation, file-system integrity impact, and denial of service by filling the disk where the Apex One server is installed. The flaw does not directly imply data disclosure, but it can disrupt endpoint security management and update operations.

Why it matters to the business

Successful exploitation can degrade or disable a Trend Micro Apex One management server by exhausting disk space or polluting server-side submission storage with attacker-controlled files. This can interrupt endpoint protection management, agent communication, policy deployment, alerting, and administrative access. Because exploitation is unauthenticated, network-accessible Apex One servers are at elevated risk, and the high EPSS score indicates meaningful likelihood of exploitation activity even though the vulnerability is not currently listed in CISA KEV and has not been flagged as ransomware-associated.

How an attack unfolds

An attacker first identifies a reachable Trend Micro Apex One server exposing the OfficeScan/Apex One web console paths. They then send HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe using a malformed Content-Length header that bypasses or confuses request validation. The server accepts the request and writes attacker-supplied content into the SampleSubmission directory. By repeating the request with many files or very large payloads, the attacker can rapidly consume disk space on the Apex One server. Once the disk is full or near full, Apex One services may fail to process submissions, write logs, update components, communicate reliably with agents, or remain administratively usable. The attack does not require authentication or user interaction and can be performed remotely wherever the vulnerable endpoint is reachable.

How to fix it

Upgrade the affected Trend Micro Apex One server from vulnerable build 11110 to the latest vendor-supported build, hotfix, or critical patch level. No exact fixed version was provided in the input, so administrators should consult Trend Micro’s advisory for CVE-2023-0587 and apply the most recent Apex One server update applicable to their deployment. Until patched, restrict network access to the Apex One management console and /officescan paths to trusted administrative networks, block unauthenticated HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe at a reverse proxy, WAF, or firewall where operationally safe, monitor and enforce disk-space thresholds, and periodically clean unexpected files from the SampleSubmission directory after confirming they are not needed for legitimate troubleshooting or malware sample workflows.

How to confirm the fix worked

Confirm the Apex One server is no longer running build 11110 and is updated to a vendor-supported fixed or current build. Validate that unauthenticated HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe are rejected or blocked. Review web server access logs to ensure the vulnerable endpoint is not reachable from untrusted networks. Check that the SampleSubmission directory does not accept arbitrary unauthenticated uploads and that disk utilization remains stable after testing. Where a WAF or proxy mitigation is used, verify rules block PUT requests to the CGI endpoint without interfering with legitimate Apex One management functions.

Typical attack path

1. Scan for internet-facing or internally reachable Trend Micro Apex One / OfficeScan web console endpoints.
2. Confirm the presence of the vulnerable CGI endpoint at /officescan/console/html/cgi/fcgiOfcDDA.exe.
3. Send a crafted HTTP PUT request containing a malformed Content-Length header.
4. Upload attacker-controlled content into the server-side SampleSubmission directory.
5. Repeat uploads or send large payloads to consume disk space.
6. Cause service degradation, failed writes, logging failures, management disruption, or denial of service on the Apex One server.

How to detect it

To determine whether exploitation already occurred, review Apex One web server logs, IIS logs if applicable, reverse proxy logs, WAF logs, and network telemetry for HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe. Pay particular attention to requests with abnormal or inconsistent Content-Length values, large request bodies, repeated uploads from the same source, high request rates, unusual user agents, unauthenticated access, and responses indicating successful handling of the request. Examine the Apex One SampleSubmission directory, commonly \PCCSRV\TEMP\SampleSubmission, for unexpected files, unusually large files, high file counts, recent bursts of file creation, suspicious extensions, or files not associated with legitimate sample submission activity. Correlate file creation timestamps with web access log entries and source IP addresses. Check Windows System and Application logs, Apex One application logs, and storage monitoring for disk-full, write-failure, service-failure, or application-error messages around the same time. Because the main impact is file write and disk exhaustion rather than code execution, focus detection on request patterns, file-system artifacts, and disk-capacity events rather than malware execution alone.

• PUT /officescan/console/html/cgi/fcgiOfcDDA.exe
• /officescan/console/html/cgi/fcgiOfcDDA.exe
• fcgiOfcDDA.exe
• \PCCSRV\TEMP\SampleSubmission
• PCCSRV\TEMP\SampleSubmission
• SampleSubmission
• There is not enough space on the disk
• disk full
• not enough free space
• HTTP PUT

What your security team should do

• Prioritize patching Apex One servers because the vulnerability is unauthenticated, remotely reachable, high severity, and has a relatively high EPSS score.
• Identify all Apex One and legacy OfficeScan management servers, including non-internet-facing systems reachable from internal networks or VPNs.
• Restrict access to Apex One web console paths to trusted administrative subnets only.
• Block or alert on HTTP PUT requests to /officescan/console/html/cgi/fcgiOfcDDA.exe, especially from unauthenticated or untrusted sources.
• Monitor \PCCSRV\TEMP\SampleSubmission for rapid file growth, unusual file counts, large files, or unexpected timestamps.
• Create disk-space alerts for the volume hosting the Apex One server and investigate sudden consumption immediately.
• Review historical web logs and file-system timestamps for evidence of prior exploitation before deleting suspicious uploaded files.
• If exploitation is suspected, preserve web logs, suspicious uploaded files, file metadata, and relevant Windows event logs for forensic review.