CVE-2024-38389

Executive Summary

CVE-2024-38389 is an Out-of-bounds Read vulnerability affecting Fuji Electric TELLUS and TELLUS Lite software versions 4.0.19.0 and earlier. This flaw allows an attacker to craft a malicious file that, when opened by a user, can lead to information disclosure and potentially arbitrary code execution. The vulnerability resides in the parsing logic of the application, where insufficient bounds checking on user-supplied data can cause the application to read memory outside the intended buffer. This can expose sensitive data or be leveraged to achieve code execution in the context of the affected application.

The vulnerability is classified as a memory safety issue (CWE-125) and is particularly dangerous in industrial control system (ICS) environments where TELLUS is used for HMI (Human-Machine Interface) programming. The lack of a publicly available patch at the time of analysis increases the risk for organizations relying on this software.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It affects a standalone desktop application (TELLUS/TELLUS Lite) used in industrial automation.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, which likely indicates that the score has not yet been assigned or calculated. Based on the description and impact, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

• Attack Vector (AV): Local (L) – The attacker must have local access to the system or convince a user to open a file.
• Attack Complexity (AC): Low (L) – The attack does not require special conditions.
• Privileges Required (PR): None (N) – No privileges are needed to trigger the vulnerability.
• User Interaction (UI): Required (R) – The user must open the malicious file.
• Scope (S): Unchanged (U) – The vulnerability does not affect resources beyond the vulnerable component.
• Confidentiality (C): High (H) – Information disclosure is possible.
• Integrity (I): High (H) – Arbitrary code execution can compromise integrity.
• Availability (A): High (H) – Code execution can lead to denial of service.

Threat Level: High. The ability to execute arbitrary code with user interaction makes this a serious threat, especially in OT/ICS environments where TELLUS is used.

Deep Dive & Mechanics

The vulnerability is an Out-of-bounds Read (CWE-125) in the file parsing functionality of TELLUS and TELLUS Lite. The application processes specially crafted files (likely project files or data files) without properly validating the size of input data before reading it into a buffer.

Technical Details:

• The vulnerable code likely reads a length field from the file and uses it to copy data into a fixed-size buffer.
• If the length field is larger than the buffer size, the application reads beyond the allocated memory, causing an out-of-bounds read.
• This can lead to:
  • Information Disclosure: Reading adjacent memory may leak sensitive data such as credentials, encryption keys, or other process data.
  • Arbitrary Code Execution: By carefully crafting the file, an attacker can control the data read out-of-bounds and potentially overwrite critical data structures or function pointers, leading to code execution.

Attack Vector:

• The attacker creates a malicious file (e.g., a .tls or .tlu project file) with a manipulated header or data block.
• The file is delivered to the victim via email, USB drive, or other means.
• When the victim opens the file in TELLUS or TELLUS Lite, the vulnerable parsing routine triggers the out-of-bounds read.

Vulnerable vs. Patched Code

Since no patch is available, a direct comparison is not possible. However, the vulnerable code pattern is typical of C/C++ applications where user-supplied data is used without proper bounds checking.

Vulnerable Code Example (Hypothetical):

void parse_file(char *file_data, int file_size) {
    char buffer[256];
    int data_len = *(int*)file_data; // Read length from file
    memcpy(buffer, file_data + 4, data_len); // No bounds check
}

Patched Code Example (Hypothetical):

void parse_file(char *file_data, int file_size) {
    char buffer[256];
    int data_len = *(int*)file_data;
    if (data_len > sizeof(buffer)) {
        // Handle error
        return;
    }
    memcpy(buffer, file_data + 4, data_len);
}

The patch would involve adding a bounds check to ensure data_len does not exceed the buffer size.

Exploitation & Lab Setup

Red Team (Offensive)

Lab Setup:

• Install TELLUS v4.0.19.0 on a Windows 10/11 VM.
• Use a debugger (e.g., x64dbg, IDA Pro) to analyze the file parsing routine.
• Create a fuzzer to generate malformed files and monitor for crashes.

Exploitation Steps:

1. Identify the vulnerable function by fuzzing and crash analysis.
2. Craft a malicious file with a manipulated length field to trigger an out-of-bounds read.
3. Use the leaked data to bypass ASLR or leak sensitive information.
4. If code execution is possible, overwrite a function pointer or return address to gain control.

Example Payload (Hypothetical):

import struct

# Craft a malicious file
buffer = b'\x00' * 4  # Placeholder for length
buffer += b'A' * 256  # Normal data
buffer += struct.pack('<I', 0x41414141)  # Overwrite length to cause OOB read

with open('malicious.tls', 'wb') as f:
    f.write(buffer)

Blue Team (Defensive)

Detection:

• Monitor for unusual file opens by TELLUS.exe or TELLUSLite.exe.
• Use Sysmon to log process creation and file access events.
• Deploy EDR rules to detect out-of-bounds read patterns (e.g., access violations).

Mitigation:

• Restrict execution of TELLUS to trusted users only.
• Use application whitelisting to prevent unauthorized software.
• Implement file integrity monitoring for TELLUS project files.
• Educate users not to open files from untrusted sources.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available publicly; generate upon discovery)
• Process Names: TELLUS.exe, TELLUSLite.exe
• File Extensions: .tls, .tlu (typical TELLUS project files)
• Network Indicators: None (local file-based attack)
• Registry Keys: N/A
• YARA Rule: See Detection Engineering section.

Detection Engineering

YARA Rule

rule CVE_2024_38389_TELLUS_OOB_Read {
    meta:
        description = "Detects malicious TELLUS files exploiting CVE-2024-38389"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-38389"
    strings:
        $magic = { 54 45 4C 4C } // "TELL" magic bytes (hypothetical)
        $oob_pattern = { FF FF FF FF } // Example pattern for oversized length
    condition:
        $magic at 0 and $oob_pattern
}

Sigma Rule

title: CVE-2024-38389 TELLUS Out-of-Bounds Read Exploitation
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects potential exploitation of CVE-2024-38389 via abnormal TELLUS process behavior
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\TELLUS.exe'
            - '\TELLUSLite.exe'
        CommandLine|contains: '.tls'
    condition: selection
falsepositives:
    - Legitimate use of TELLUS with project files
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-38389 TELLUS Malicious File Download"; flow:to_server,established; content:"|54 45 4C 4C|"; distance:0; within:4; classtype:attempted-user; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate Affected Systems: Disconnect TELLUS workstations from the network if possible.
2. User Awareness: Train users to avoid opening untrusted files.
3. File Blocking: Block .tls and .tlu file extensions at email gateways and web proxies.

Long-term Fix:

• Monitor Fuji Electric’s security advisories for a patch.
• Apply the patch as soon as it becomes available.
• Consider migrating to alternative HMI software if no patch is released.

Compensating Controls:

• Use application sandboxing (e.g., Windows Defender Application Guard) to run TELLUS in an isolated environment.
• Implement strict file access controls using Windows DACLs.
• Deploy endpoint detection and response (EDR) solutions with behavioral analysis.

Valters IT
DevSecOps & Cyber Threat Intelligence