CVE-2026-8360

Executive Summary

CVE-2026-8360 is a NULL pointer dereference vulnerability in Triofox Server Agent components, specifically within the WOSCommonUtil.dll library. The flaw resides in the WOSSysInfoGetDeviceInterface() function, which is called by multiple DLLs such as WOSProfileMgrModule.dll and WOSWebDavModule.dll. When no user is logged into the Triofox Server Agent Management Console, the function returns a NULL pointer. This pointer is subsequently dereferenced without a proper check, leading to a denial of service (DoS) condition. The vulnerability has a CVSS score of 7.5 (High) and currently has no known patch or public exploit. The EPSS score is 0.0%, indicating low exploitation activity in the wild.

Supply Chain & Package Security

This vulnerability is not related to any open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows-based application (Triofox Server Agent). No supply chain implications are identified.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N) – The vulnerability can be triggered remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – The vulnerable component remains isolated.
• Confidentiality Impact: None (C:N) – No data exposure.
• Integrity Impact: None (I:N) – No data modification.
• Availability Impact: High (A:H) – Successful exploitation causes a crash or denial of service.

Threat Level: High. The vulnerability is remotely exploitable with low complexity and no authentication, making it attractive for DoS attacks against Triofox Server Agent instances.

Deep Dive & Mechanics

The vulnerability is a classic NULL pointer dereference (CWE-476). The function WOSSysInfoGetDeviceInterface() in WOSCommonUtil.dll is designed to retrieve device interface information. Under normal conditions, it returns a valid pointer. However, when the Triofox Server Agent Management Console has no active user session, the function returns NULL.

The callers of this function, such as WOSProfileMgrModule.dll and WOSWebDavModule.dll, do not validate the return value before dereferencing it. This leads to an access violation (segmentation fault) when the NULL pointer is used, crashing the affected service.

Root Cause: Missing NULL check after calling WOSSysInfoGetDeviceInterface().

Attack Vector: An unauthenticated remote attacker can send a crafted request to the Triofox Server Agent that triggers the vulnerable code path. For example, a request to a WebDAV endpoint that invokes WOSWebDavModule.dll could cause the NULL dereference.

Impact: Denial of service (DoS) – the Triofox Server Agent process terminates, disrupting file sharing and management services.

Vulnerable vs. Patched Code

Vulnerable Code (C++ pseudocode):

// In WOSWebDavModule.dll or WOSProfileMgrModule.dll
void* pInterface = WOSSysInfoGetDeviceInterface();
// No NULL check
pInterface->SomeMethod(); // NULL pointer dereference

Patched Code (C++ pseudocode):

void* pInterface = WOSSysInfoGetDeviceInterface();
if (pInterface == NULL) {
    // Handle error gracefully, e.g., return error code
    return E_POINTER;
}
pInterface->SomeMethod();

Patch Status: No official patch has been released by Triofox. The vendor has not acknowledged the vulnerability publicly.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• A Triofox Server Agent instance (version unknown) with the Management Console not logged in.
• Network access to the Triofox service (typically port 443 or 80 for WebDAV).

Exploitation Steps:

1. Identify a Triofox Server Agent via Shodan or network scanning (e.g., using the dork Triofox).
2. Send a crafted HTTP request to a WebDAV endpoint that triggers the vulnerable code path. Example:

   PROPFIND / HTTP/1.1
   Host: target:443
   Depth: 0
   

3. The server crashes due to NULL pointer dereference, causing a denial of service.

Proof-of-Concept (PoC) Script (Python):

import requests

target = "https://target:443"
try:
    # Send a PROPFIND request to trigger WebDAV module
    response = requests.request("PROPFIND", target, timeout=5)
    print(f"Response: {response.status_code}")
except requests.exceptions.ConnectionError:
    print("Target crashed (DoS achieved)")

Note: No public exploit code exists. The above is a conceptual PoC.

Blue Team (Defense & Detection)

Detection:

• Monitor for crashes of the TriofoxServerAgent.exe process.
• Look for event logs indicating access violations (Event ID 1000 in Windows Application log).
• Network traffic analysis: Unusual WebDAV requests (PROPFIND, OPTIONS) to Triofox services.

Mitigation:

• Restrict network access to Triofox Server Agent to trusted IPs only.
• Ensure the Management Console is always logged in (workaround).
• Apply vendor patch when available.

Indicators of Compromise (IOCs)

• Process Crash: TriofoxServerAgent.exe terminates unexpectedly.
• Windows Event Log: Event ID 1000 with faulting module WOSCommonUtil.dll and exception code 0xc0000005 (access violation).
• Network Traffic: HTTP/HTTPS requests to Triofox WebDAV endpoints (e.g., PROPFIND, OPTIONS).
• File Artifacts: Crash dumps in %PROGRAMDATA%\Triofox\Server\CrashDumps\.

Detection Engineering

YARA Rule

rule CVE_2026_8360_NULL_PTR_DEREF {
    meta:
        description = "Detects NULL pointer dereference in Triofox WOSCommonUtil.dll"
        author = "Valters IT"
        date = "2026-01-01"
        reference = "CVE-2026-8360"
    strings:
        $s1 = "WOSSysInfoGetDeviceInterface" ascii wide nocase
        $s2 = "WOSCommonUtil.dll" ascii wide nocase
    condition:
        $s1 and $s2
}

Sigma Rule

title: Triofox Server Agent NULL Pointer Dereference (CVE-2026-8360)
id: 8a4b3c2d-1e5f-4a7b-9c8d-0e1f2a3b4c5d
status: experimental
description: Detects crashes of TriofoxServerAgent.exe due to NULL pointer dereference in WOSCommonUtil.dll
author: Valters IT
date: 2026-01-01
logsource:
    product: windows
    service: application
detection:
    selection:
        EventID: 1000
        Provider_Name: 'Application Error'
        Faulting_Module: '*WOSCommonUtil.dll*'
        Exception_Code: '0xc0000005'
    condition: selection
falsepositives:
    - Other crashes unrelated to this CVE
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2026-8360 Triofox WebDAV NULL Pointer Dereference Attempt"; flow:to_server; content:"PROPFIND"; http_method; content:"Depth"; http_header; classtype:attempted-dos; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Workaround: Ensure at least one user is logged into the Triofox Server Agent Management Console at all times to prevent the NULL pointer return.
2. Network Segmentation: Restrict access to the Triofox Server Agent to trusted internal networks only. Use firewall rules to block external access.
3. Monitoring: Enable crash dump collection and monitor for Event ID 1000 with WOSCommonUtil.dll as the faulting module.

Long-Term Fix:

• Apply the official patch from Triofox when released.
• If no patch is forthcoming, consider migrating to an alternative file sharing solution.

Vendor Contact: Triofox (https://www.triofox.com/) – No response received as of this report.

Valters IT