CVE-2016-9260 in Nessus
Summary
by MITRE
Cross-site scripting (XSS) vulnerability in Tenable Nessus before 6.9 allows remote authenticated users to inject arbitrary web script or HTML via vectors related to handling of .nessus files.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 08/08/2020
The CVE-2016-9260 vulnerability represents a critical cross-site scripting flaw in Tenable Nessus versions prior to 6.9, exposing organizations to significant web application security risks. This vulnerability specifically targets the handling of .nessus files within the Nessus security scanning platform, which is widely used for network vulnerability assessment and penetration testing. The flaw enables remote authenticated attackers to execute malicious scripts within the context of a victim's browser session, potentially compromising the security of legitimate users who interact with the Nessus interface.
The technical exploitation of this vulnerability occurs through the improper sanitization of user-supplied input during the processing of .nessus files. When a user uploads or imports a maliciously crafted .nessus file, the application fails to adequately validate or escape special characters that could be interpreted as HTML or JavaScript code. This weakness falls under the CWE-79 category of Cross-site Scripting, specifically representing a stored XSS variant where the malicious payload is embedded within the .nessus file itself and executed when other users view the scan results or interact with the imported data within the Nessus web interface.
The operational impact of this vulnerability extends beyond simple script injection, as it can enable attackers to perform a wide range of malicious activities including session hijacking, credential theft, and data exfiltration. An authenticated attacker with access to the Nessus platform can craft a malicious .nessus file that, when viewed by another user, would execute arbitrary JavaScript code in their browser context. This could allow the attacker to steal session cookies, redirect users to phishing sites, or even modify scan results to hide malicious activity. The vulnerability particularly affects organizations that rely heavily on Nessus for security assessments, as it creates a vector for attackers to compromise the security of the scanning infrastructure itself.
From an ATT&CK framework perspective, this vulnerability maps to multiple techniques including T1059.007 for command and scripting interpreter and T1566 for credential access through social engineering. The exploitation chain typically involves an attacker gaining legitimate access to Nessus, crafting a malicious .nessus file with embedded XSS payloads, and then persuading a victim user to import or view the compromised file. Organizations using Nessus for security operations are particularly vulnerable since the platform is often used by security teams who may be less cautious about importing files from untrusted sources. The remediation strategy requires immediate patching to Nessus version 6.9 or later, along with implementation of proper input validation and output encoding mechanisms. Additional defensive measures include network segmentation, regular security awareness training for users, and monitoring for suspicious file upload activities within the Nessus environment to prevent exploitation attempts.