CVE-2024-1367: Tenable Security Center RCE Vulnerability

CVE-2024-1367 Overview

CVE-2024-1367 is a command injection vulnerability [CWE-78] in Tenable Security Center. An authenticated remote attacker with administrator privileges can modify Logging parameters to execute arbitrary operating system commands on the Security Center host. The flaw affects the vulnerability management application used by enterprises for continuous security monitoring and compliance reporting. Successful exploitation grants the attacker code execution in the context of the Security Center service account, compromising confidentiality, integrity, and availability of the host.

Critical Impact
Authenticated administrators can leverage crafted Logging parameter values to inject operating system commands, resulting in arbitrary code execution on the Security Center host.

Affected Products

Tenable Security Center (versions prior to the fixed release noted in Tenable Security Advisory TNS-2024-02)

Discovery Timeline

2024-02-14 - CVE-2024-1367 published to NVD
2026-06-17 - Last updated in NVD database

Technical Details for CVE-2024-1367

Vulnerability Analysis

The vulnerability resides in the Logging configuration functionality of Tenable Security Center. The application accepts administrator-supplied values for Logging parameters and passes them into a shell context without adequate sanitization. An attacker with an authenticated administrator session can craft parameter values containing shell metacharacters. The application then executes those characters as part of an underlying operating system command. The result is arbitrary code execution in the security context of the Security Center runtime user, which typically has broad access to scan data, credentials, and API tokens.

Root Cause

The root cause is improper neutralization of special elements used in an OS command, categorized under [CWE-78]. The Logging parameter handler concatenates user-controlled input into a command string rather than invoking the underlying binary with argument arrays or applying strict allowlists. Because the affected endpoint sits behind administrator authentication, the vendor scoped the required privileges as PR:H, but the network attack vector (AV:N) allows exploitation from any remote host reachable over the management interface.

Attack Vector

Exploitation requires valid administrator credentials or a hijacked administrator session on the Security Center web console. The attacker submits a modified Logging parameter value through the standard management interface. The injected payload is embedded within a shell command constructed server-side. When the command executes, the payload runs with the privileges of the Security Center process. This vector is commonly abused in post-compromise scenarios, where an attacker who has phished or otherwise obtained administrator credentials pivots to full host compromise. See the Tenable Security Advisory TNS-2024-02 for vendor-supplied technical details.

Detection Methods for CVE-2024-1367

Indicators of Compromise

Unexpected child processes spawned by the Security Center service account, particularly shells such as /bin/sh, /bin/bash, or nc.
Modifications to Logging configuration parameters that contain shell metacharacters (;, |, &&, backticks, $(...)).
Outbound network connections initiated by the Security Center host to unfamiliar external addresses.
New or modified files under Security Center working directories that do not correlate with vendor updates.

Detection Strategies

Audit Security Center administrator activity logs for changes to Logging parameters and correlate with the source IP and user account.
Monitor process lineage on the Security Center host for shell interpreters or scripting engines descending from the Security Center application process.
Enable command-line auditing (auditd on Linux) and alert on execution chains rooted at Security Center binaries.

Monitoring Recommendations

Forward Security Center application logs and host telemetry to a centralized analytics platform for correlation and retention.
Alert on administrator logins from new geolocations, new user agents, or outside approved change windows.
Baseline normal Security Center child-process behavior and generate alerts on deviations from that baseline.

How to Mitigate CVE-2024-1367

Immediate Actions Required

Apply the fixed Security Center version referenced in Tenable Security Advisory TNS-2024-02 as soon as change windows permit.
Rotate all administrator credentials and API tokens used with Security Center, especially if administrator access is not tightly controlled.
Restrict network access to the Security Center management interface to trusted administrative subnets only.
Review Security Center audit logs for unauthorized Logging parameter changes since the last known-good state.

Patch Information

Tenable published fixed builds of Security Center in advisory TNS-2024-02. Administrators should upgrade to the version listed in the Tenable Security Advisory TNS-2024-02 that resolves the command injection in Logging parameters. Validate the upgrade in a staging environment, then roll it out to production Security Center consoles. After patching, confirm that the Logging parameter handler rejects shell metacharacters through vendor-provided release notes.

Workarounds

Limit the number of accounts granted the Security Center administrator role and require multi-factor authentication for those accounts.
Place the Security Center console behind a VPN or jump host to reduce network exposure of the management interface.
Monitor Logging configuration for unauthorized modifications until the patched release is deployed.

bash

# Example: restrict Security Center management interface to an admin subnet using iptables
iptables -A INPUT -p tcp --dport 443 -s 10.20.30.0/24 -j ACCEPT
iptables -A INPUT -p tcp --dport 443 -j DROP