CVE-2024-2390: Nessus Plugin Privilege Escalation Flaw

CVE-2024-2390 Overview

CVE-2024-2390 is a local privilege escalation vulnerability affecting a Nessus plugin, disclosed through Tenable's vulnerability disclosure program. An attacker with sufficient permissions on a scan target can place a binary in a specific filesystem location and abuse the vulnerable plugin to escalate privileges. The weakness maps to [CWE-269] Improper Privilege Management. Exploitation requires local access and user interaction, but successful attacks yield high impact to confidentiality, integrity, and availability.

Critical Impact
A local attacker with scan-target permissions can escalate privileges by planting a malicious binary in a filesystem path referenced by the affected Nessus plugin.

Affected Products

Tenable Nessus (affected plugin distributed via plugin feed)
Systems where the Nessus scanner executes authenticated scans against attacker-controlled targets
Endpoints running the vulnerable plugin version prior to remediation

Discovery Timeline

2024-03-18 - CVE-2024-2390 published to the National Vulnerability Database
2026-06-17 - Last updated in the NVD database

Technical Details for CVE-2024-2390

Vulnerability Analysis

The vulnerability resides in a Nessus plugin that executes on scan targets during authenticated scanning. The plugin loads or executes a binary from a filesystem location that is writable by unprivileged users. An attacker with local permissions on the scan target can plant a malicious binary at this location. When the plugin runs under elevated privileges, it invokes the attacker-controlled binary, granting code execution at a higher privilege level.

This class of flaw stems from insecure trust of filesystem paths and permissions during privileged operations. The exploit path requires local access and user interaction, which in scanning contexts typically means an administrator initiating an authenticated scan. Tenable identified the issue through its vulnerability disclosure program and released a fixed plugin feed.

Root Cause

The root cause is improper privilege management [CWE-269]. The vulnerable plugin does not validate the ownership, permissions, or integrity of the binary it invokes. Because the referenced filesystem location is writable by lower-privileged accounts, an attacker can substitute a malicious executable that runs with the plugin's effective privileges.

Attack Vector

Exploitation is local. The attacker requires prior access to the scan target with sufficient permissions to write to the specific filesystem location referenced by the plugin. When an authenticated Nessus scan runs the affected plugin, the planted binary executes with elevated privileges. Refer to the Tenable Security Advisory for the specific plugin identifier and remediation details.

No public proof-of-concept exploit is available, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2024-2390

Indicators of Compromise

Unexpected executable files appearing in filesystem paths referenced by Nessus plugins on scanned hosts
Process creation events where a Nessus plugin process spawns a child binary from a user-writable directory
Modification of files in plugin-referenced paths shortly before a scheduled authenticated scan

Detection Strategies

Audit file integrity for directories used by Nessus plugins during authenticated scans, alerting on writes by non-privileged accounts
Correlate Nessus scanner activity with process execution telemetry to identify anomalous child processes launched with elevated tokens
Review Nessus plugin feed version on all scanners and flag deployments running versions prior to the Tenable-published fix

Monitoring Recommendations

Enable endpoint process and file telemetry on all systems targeted by authenticated Nessus scans
Ship Nessus scanner logs and endpoint telemetry to a centralized data lake to correlate scan events with local privilege changes
Monitor for new setuid binaries or scheduled tasks created around scan windows

How to Mitigate CVE-2024-2390

Immediate Actions Required

Update the Nessus plugin feed to the version containing the fix, as documented in the Tenable advisory
Restrict which accounts on scan targets can write to filesystem locations invoked by scanning plugins
Review credentials used for authenticated Nessus scans and rotate any that may have been exposed on compromised hosts

Patch Information

Tenable released a corrected plugin through the Nessus plugin feed. Administrators should ensure their scanners are configured to automatically retrieve plugin updates and verify the current plugin set post-update. See the Tenable Security Advisory for authoritative remediation guidance.

Workarounds

Disable the affected plugin in scan policies until the updated plugin feed is installed
Limit authenticated scanning to trusted, hardened targets where local write access is tightly controlled
Apply least-privilege file permissions on directories referenced by scanner-invoked binaries

bash

# Update Nessus plugins to obtain the fixed plugin set
/opt/nessus/sbin/nessuscli update --plugins-only
/opt/nessus/sbin/nessuscli fix --secure --list