CVE-2022-32973: Tenable Nessus Privilege Escalation Flaw

CVE-2022-32973 Overview

CVE-2022-32973 is a privilege escalation vulnerability in Tenable Nessus that allows an authenticated attacker to create an audit file that bypasses PowerShell cmdlet checks and executes commands with administrator privileges. This vulnerability represents a significant security risk as it enables authenticated users to elevate their privileges beyond their authorized access level.

Critical Impact

Authenticated attackers can bypass security controls and execute arbitrary commands with administrator privileges, potentially leading to complete system compromise.

Affected Products

• Tenable Nessus (versions prior to the security patch)

Discovery Timeline

• 2022-06-21 - CVE CVE-2022-32973 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2022-32973

Vulnerability Analysis

This vulnerability affects Tenable Nessus, a widely-deployed vulnerability scanner used by security professionals worldwide. The flaw exists in the audit file handling mechanism, specifically in how PowerShell cmdlet restrictions are enforced. An authenticated attacker can craft a malicious audit file that circumvents the security checks designed to prevent unauthorized command execution.

The attack requires network access and low-privilege authentication, but no user interaction is needed. Once exploited, the attacker gains the ability to execute commands with administrator-level privileges, potentially compromising the confidentiality, integrity, and availability of the affected system.

Root Cause

The vulnerability stems from insufficient validation of audit files processed by Tenable Nessus. The PowerShell cmdlet check mechanism fails to properly sanitize or validate certain inputs within audit files, allowing attackers to inject commands that bypass these security controls. This improper input validation enables privilege escalation when the malicious audit file is processed.

Attack Vector

The attack is executed over the network and requires authentication to the Nessus interface. The attacker must have valid credentials with at least low-level access to the system. The exploitation workflow involves:

1. An authenticated attacker creates a specially crafted audit file
2. The audit file contains malicious content designed to bypass PowerShell cmdlet checks
3. When the audit file is processed by Nessus, the security checks are circumvented
4. Commands within the malicious audit are executed with administrator privileges

The vulnerability mechanism allows an authenticated user to bypass PowerShell cmdlet validation through crafted audit files. The specific technical details of the bypass involve improper handling of audit file contents during the PowerShell command execution flow. For complete technical details, refer to the Tenable Security Advisory.

Detection Methods for CVE-2022-32973

Indicators of Compromise

• Unusual or unexpected audit files appearing in Nessus directories
• PowerShell execution logs showing commands executed with elevated privileges from Nessus context
• Anomalous administrative actions traced back to low-privilege authenticated users
• Unexpected modifications to system configurations following Nessus scan activities

Detection Strategies

• Monitor Nessus audit file creation and modification events for suspicious patterns
• Implement logging and alerting for PowerShell command execution originating from the Nessus service
• Review authentication logs for unusual access patterns to the Nessus console
• Deploy endpoint detection and response (EDR) solutions to monitor for privilege escalation attempts

Monitoring Recommendations

• Enable comprehensive logging for Tenable Nessus activities and audit file processing
• Configure SIEM rules to correlate Nessus authentication events with subsequent privilege escalations
• Monitor for creation of audit files by users who do not typically create them
• Implement file integrity monitoring on Nessus configuration and audit directories

How to Mitigate CVE-2022-32973

Immediate Actions Required

• Apply the latest security patches from Tenable immediately
• Review and audit all existing Nessus user accounts and their privilege levels
• Temporarily restrict access to audit file creation to only trusted administrators
• Monitor for any signs of exploitation in your environment

Patch Information

Tenable has released a security patch addressing this vulnerability. Organizations running Tenable Nessus should upgrade to the patched version as soon as possible. Detailed patch information and upgrade instructions are available in the Tenable Security Advisory TSN-2022-11.

Workarounds

• Implement strict access controls limiting which users can create or modify audit files
• Enable enhanced logging and monitoring for all Nessus activities
• Review and restrict network access to Nessus management interfaces
• Consider implementing additional authentication mechanisms such as MFA for Nessus access

# Verify Nessus version and check for available updates
/opt/nessus/sbin/nessuscli fix --list

# Review Nessus user accounts and permissions
/opt/nessus/sbin/nessuscli lsuser

# Enable enhanced logging (refer to Tenable documentation for your version)
# Consult https://www.tenable.com/security/tns-2022-11 for specific guidance