CVE-2017-7850 in Nessus
Summary
by MITRE
Nessus 6.10.x before 6.10.5 was found to be vulnerable to a local privilege escalation issue due to insecure permissions when running in Agent Mode.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 09/17/2020
The vulnerability identified as CVE-2017-7850 affects Tenable Nessus versions 6.10.x prior to 6.10.5 and represents a critical local privilege escalation flaw that arises from insecure file permissions when Nessus operates in Agent Mode. This vulnerability specifically targets the configuration management aspects of the Nessus security scanner, creating a pathway for unauthorized local users to escalate their privileges within the system. The issue stems from the improper handling of file and directory permissions during the agent mode execution, which allows malicious actors with low-privilege access to manipulate critical system components. When Nessus runs in Agent Mode, it typically operates with elevated privileges to perform comprehensive system scans, but the insecure permission model creates a dangerous attack surface that undermines the security boundaries intended by the application's design.
The technical flaw manifests through the improper assignment of file permissions for temporary files and configuration directories that Nessus creates during its operation. In Agent Mode, the application generates various temporary files and maintains specific directory structures that require careful permission management to prevent unauthorized access. Attackers can exploit this weakness by creating symbolic links or manipulating file paths to gain access to files that should normally be restricted to the root user or system processes. This vulnerability directly maps to CWE-276, which describes inadequate file permissions, and represents a classic example of insecure permissions in Unix-like systems where insufficient access controls allow privilege escalation. The flaw enables attackers to potentially read sensitive configuration files, modify system settings, or even replace critical binaries with malicious versions that will execute with elevated privileges.
The operational impact of this vulnerability extends beyond simple privilege escalation, as it fundamentally compromises the integrity and security posture of systems running vulnerable Nessus versions. Organizations that deploy Nessus in Agent Mode across their networks face significant risk, as any compromised low-privilege account could potentially be used to gain root access to the underlying systems. This creates a particularly dangerous scenario in enterprise environments where Nessus agents are often deployed with elevated privileges to scan network resources effectively. The vulnerability also aligns with ATT&CK technique T1068, which covers privilege escalation through local exploits, and T1059, which involves executing malicious code through system commands. Security teams may not immediately detect this compromise since the malicious activity occurs within legitimate system processes, making it difficult to distinguish between normal scanning operations and unauthorized privilege escalation attempts.
Mitigation strategies for CVE-2017-7850 primarily involve updating Nessus to version 6.10.5 or later, which addresses the insecure permission handling issue through proper file permission controls and enhanced security checks during agent mode operations. Organizations should also implement immediate remediation measures such as verifying file permissions on existing Nessus installations, monitoring for unauthorized access to Nessus-related directories, and conducting comprehensive security audits of systems running vulnerable versions. System administrators should consider running Nessus in Client Mode instead of Agent Mode where possible, as this reduces the attack surface by eliminating the need for elevated privileges during agent operations. Additional protective measures include implementing strict access controls for Nessus-related directories, monitoring system logs for suspicious file access patterns, and ensuring that Nessus agents are only deployed on systems where the risk of local privilege escalation is properly mitigated through network segmentation and user access controls. The vulnerability serves as a reminder of the critical importance of proper permission management in security tools and the potential for seemingly benign configuration options to create significant security risks when not properly secured.