Securin’s Expert Discovers a Zero-Day Vulnerability in Tenable’s Nessus Scanner

How Could This Vulnerability Be Exploited?

Proof of Concept

Figure 1: Creating the Nessus Policy with the Windows Credential Type

Figure 2: Creating the Process Dump of the “nessusd” Process

Figure 3: Created the Process Dump of the “nessusd” Process

Figure 4: Parsing the DMP File Using Strings and Extracting Credentials

Figure 5: The Nessus Policy-Stored Windows Credentials Retrieved in Cleartext

Impact of the Vulnerability

1. An attacker can retrieve stored credentials in Nessus Policies in cleartext from the “nessusd” process.
2. An attacker can potentially compromise corresponding assets, internal domains, and networks with the retrieved credentials.
3. With disclosed credentials, an attacker can potentially compromise an organization’s associated assets and networks, leading to infiltration and breach.

Timeline

1. April 25, 2022: Securin’s expert discovered CVE-2022-28291 in Nessus Professional version 10.1.1 (#61)
2. May 02, 2022: Reported to Tenable’s team
3. June 02, 2022: Tenable proposed a potential fix in Nessus 10.4 or in a later release
4. August 04, 2022: Tenable deemed the reported vulnerability as an acceptable risk
5. August 31, 2022: Tenable performed additional reviews and acknowledged there would be no fix for this issue
6. September 01, 2022: Tenable agreed to raise a CVE for this submission