What this actually is.
Technical background, root cause, and affected surface.
An authenticated user with debug privileges can retrieve stored Nessus policy credentials from the “nessusd” process in cleartext via process dumping. The affected products are all versions of Nessus Essentials and Professional. The vulnerability allows an attacker to access credentials stored in Nessus scanners, potentially compromising its customers’ network of assets.
- Vendor
- Tenable
- Affected Product
- Nessus Professional
- CVE
- CVE-2022-28291
- Securin ID
- -
- Status
- Pending Fix
- Date
- May 2, 2022
- Severity
- Medium
- CVSS Score
- 6.5
- Vector
- CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
- CWE
- CWE-522
From one request
to root shell.
Reproduced in a sandboxed environment. Requires only LAN or WiFi adjacency.
We tested the following vulnerability on Tenable’s Nessus Professional 10.1.1 (#61) Windows.
What an attacker does to you.
Post-exploitation outcomes mapped to CVSS impact metrics.
An attacker can retrieve stored credentials in Nessus Policies in cleartext from the “nessusd” process.
An attacker can potentially compromise corresponding assets, internal domains, and networks with the retrieved credentials.
With disclosed credentials, an attacker can potentially compromise its associated assets and networks of an organization.
Fix it. In this order.
A runbook, not a checklist. Sequence matters — assume compromise before you act.
Encrypt data in memory so that the retrieval of information through process dumping will require decryption.
Developers need to find a way to clear the memory location of the sensitive data to prevent persistent attacks on the main memory.
Developers need to ensure the memory location cannot be accessed by other applications, i.e., attempts through another processes to read or write.
disclose@securin.ioVendors moved in days.
Attackers in hours.
Reconstructed from vendor advisories, CISA bulletins, and Securin research records.
Discovered in Nessus Professional version 10.1.1 (#61)
Reported to Tenable’s team
Tenable proposed a potential fix in Nessus 10.4 or in a later release.
Tenable has deemed the reported vulnerability as an acceptable risk.
Tenable performed additional reviews and acknowledged there would be no fix for this issue.
Tenable has agreed to raise a CVE for this submission.
MITRE publishes CVE-2022-28291
Disclosed 176 days after discovery
Cite, verify, go deeper.
Primary sources — NVD, CISA KEV, and machine-readable IoC feed.