Date:
24-Aug-2017

Product:
Trend Micro Hosted Email Security (HES)

Versions affected:
Hosted Email Security before January 2012.

Vulnerability:

Two vulnerabilities were discovered.

The first allowed any HES user to intercept in-transit emails through
the Trend Micro Hosted Email Security cloud environment. The platform
allowed anyone to register an account online instantly and test the
solution. Users were required to 'activate' (enter) a domain name,
then update their MX records to enable filtering. However, to enable
migration testing, rules became active immediately without waiting for
MX records to be updated. This was intended, however the HES
environment itself was shared across all customers - therefore anyone
could create a policy for a domain which wasn't theirs or a
pre-existing customers and start intercepting, modifying / rewriting
content, BCC copying emails, quarantining or deleting messages which
came from@domain.com or to@jackeddomain.com if passed through HES.

Reproduction steps:

1) Register a free Trend Micro HES account.
2) Activate a domain name you want to filter - be creative (gmail.com,
mac.com, apple.com, microsoft.com, ibm.com, plus banks / military /
large ISPs / government domains worked exceptionally well!)
3) While the domain has not been valid, create a new policy rule, e.g.
"BCC all messages" to your personal email address.
4) Watch your inbox run out of disk space.

Interception revealed Sender, Recipient, Subject and in some cases
entire email contents with attachments if applicable.

Email Interception Statistics
###
7,000 emails in 3 hours.
21,000 emails in 13 hours.
78,500 emails in 24 hours.
96,000 emails in 30 hours.
1,221,535 emails in 8 days.
###

The second vulnerability allowed any HES authenticated customer to
view or change other cloud user's rules via Direct Object Reference.

E.g.

https://us.emailsec.trendmicro.com/editRule.imss?ruleid=44281
https://us.emailsec.trendmicro.com/editRule.imss?ruleid=44282
https://us.emailsec.trendmicro.com/editRule.imss?ruleid=44283 etc

Credit:
Discovered by Patrick Webster

Disclosure timeline:
09-Dec-2011 - Interception issue discovered during testing. Reported to vendor.
10-Dec-2011 - Developers investigating interception report.
11-Dec-2011 - Direct object policy rule access / edit discovered and
reported to vendor.
12-Dec-2011 - Vulnerabilities confirmed.
16-Dec-2011 - Direct object policy rule issue fixed in production.
23-Dec-2011 - Interception fix pushed to production environment.
27-Dec-2011 - Final intercepted email received (numbering several million).
28-Dec-2011 - Delivery Status Notification success/failures continue
to be received.
11-Jan-2012 - Delivery Status Notification fix pushed to production.
Last DSN received.
24-Aug-2017 - Public disclosure for historical purposes as an example
of early cloud adoption issues facing the industry.

About OSI Security:

OSI Security is an IT security consulting company based in Sydney,
Australia. We provide managed internal and external penetration
testing and ethical hacking services, web application testing,
vulnerability assessments, wireless site audits, vendor product
assessments, secure network design, forensics and risk mitigation
services.

We can be found at https://www.osisecurity.com.au/