CVE-2023-3251: Tenable Nessus Information Disclosure Flaw

CVE-2023-3251 Overview

A pass-back vulnerability exists in Tenable Nessus where an authenticated, remote attacker with administrator privileges could uncover stored SMTP credentials within the Nessus application. This vulnerability falls under CWE-522 (Insufficiently Protected Credentials), indicating that sensitive credential data is not adequately secured against unauthorized retrieval.

Critical Impact

Authenticated administrators can extract stored SMTP credentials, potentially enabling lateral movement or credential reuse attacks against email infrastructure.

Affected Products

• Tenable Nessus versions prior to 10.6.0

Discovery Timeline

• August 29, 2023 - CVE-2023-3251 published to NVD
• November 21, 2024 - Last updated in NVD database

Technical Details for CVE-2023-3251

Vulnerability Analysis

This pass-back vulnerability allows authenticated administrators to recover SMTP credentials that are stored within the Nessus application. Pass-back attacks typically involve manipulating an application's configuration to redirect authentication requests to an attacker-controlled server, thereby capturing credentials in transit or extracting them from storage. In this case, the vulnerability enables the extraction of stored SMTP credentials that Nessus uses for email notifications and reporting functionality.

The attack requires network access and administrator-level privileges within the Nessus application. While this limits the attack surface to trusted insiders or compromised administrator accounts, successful exploitation leads to complete disclosure of sensitive SMTP credentials without requiring any user interaction.

Root Cause

The root cause of this vulnerability is insufficiently protected credentials (CWE-522). The Nessus application does not adequately protect stored SMTP credentials from retrieval by authenticated administrators. This could involve improper encryption, reversible encoding, or accessible storage mechanisms that allow credential extraction through legitimate application interfaces or configuration manipulation.

Attack Vector

The attack vector is network-based, requiring the attacker to have authenticated access to the Nessus application with administrator privileges. The attacker can leverage their administrative access to either:

1. Manipulate SMTP server configuration settings to redirect credential verification to an attacker-controlled server
2. Access stored credentials through application interfaces or configuration files that expose the credential data
3. Intercept credential transmission during configuration updates or test operations

The vulnerability does not require user interaction and can be exploited remotely across the network once administrative access is obtained.

Detection Methods for CVE-2023-3251

Indicators of Compromise

• Unexpected modifications to SMTP server configuration within Nessus
• SMTP connection attempts to unauthorized or unknown mail servers from the Nessus host
• Administrative access logs showing unusual configuration export or credential-related API calls
• Network traffic indicating outbound SMTP authentication to non-corporate mail servers

Detection Strategies

• Monitor Nessus administrative audit logs for changes to email/SMTP configuration settings
• Implement network monitoring to detect SMTP traffic from Nessus servers to unauthorized destinations
• Alert on bulk configuration exports or API access patterns that could indicate credential harvesting
• Review administrative user activity for anomalous behavior patterns or off-hours access

Monitoring Recommendations

• Enable comprehensive audit logging within Nessus for all administrative actions
• Configure SIEM alerts for SMTP configuration changes in vulnerability scanning infrastructure
• Implement network segmentation rules that restrict SMTP traffic from scanner hosts to approved mail relays only
• Periodically review administrator access and permissions to ensure least privilege principles

How to Mitigate CVE-2023-3251

Immediate Actions Required

• Upgrade Tenable Nessus to version 10.6.0 or later immediately
• Audit administrator accounts and remove unnecessary elevated privileges
• Rotate SMTP credentials that may have been exposed prior to patching
• Review SMTP configuration settings for any unauthorized modifications

Patch Information

Tenable has addressed this vulnerability in Nessus version 10.6.0. Organizations should upgrade to this version or later to remediate CVE-2023-3251. For detailed patch information and upgrade instructions, refer to Tenable Security Advisory TNS-2023-29.

Workarounds

• Restrict administrative access to Nessus to essential personnel only
• Implement network segmentation to limit exposure of the Nessus management interface
• Consider using service accounts with limited permissions for SMTP configuration where possible
• Monitor and alert on all administrative configuration changes until patching is complete

# Verify Nessus version after upgrade
/opt/nessus/sbin/nessuscli fix --list | grep "Version"
# Expected: Version 10.6.0 or higher