CVE-2024-0955 in Nessus
Summary
by MITRE • 02/07/2024
A stored XSS vulnerability exists where an authenticated, remote attacker with administrator privileges on the Nessus application could alter Nessus proxy settings, which could lead to the execution of remote arbitrary scripts.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 02/07/2024
The vulnerability identified as CVE-2024-0955 represents a critical stored cross-site scripting flaw within the Nessus vulnerability scanning platform that specifically targets authenticated administrators. This weakness allows a remote attacker who has already gained administrative access to the Nessus application to manipulate proxy configuration settings in a manner that enables persistent malicious script execution. The vulnerability resides within the proxy settings management functionality of the Nessus application, where user-supplied input is not properly sanitized or validated before being stored and subsequently rendered in web interfaces. The flaw stems from inadequate input validation and output encoding mechanisms that fail to prevent malicious script code from being stored within the application's configuration data structures.
The technical exploitation of this vulnerability requires an attacker to possess valid administrative credentials and the ability to interact with the Nessus web interface to modify proxy settings. When the affected proxy configuration is processed and displayed in subsequent user sessions, the stored malicious scripts execute within the context of other authenticated users' browsers. This creates a persistent threat vector where the attacker's malicious code can compromise user sessions, steal sensitive information, or redirect users to malicious domains. The vulnerability operates under the CWE-079 classification as a stored cross-site scripting attack, where the malicious payload is stored on the server and executed when other users access the affected application components. The attack chain typically involves the attacker modifying proxy settings to include malicious JavaScript code within configuration parameters, which then gets executed when the proxy settings are displayed or processed in user interfaces.
The operational impact of CVE-2024-0955 extends beyond simple script execution as it provides attackers with the capability to establish persistent access points within the target environment. Administrators who view the proxy configuration settings become unwitting victims of the stored XSS payload, potentially leading to session hijacking, credential theft, or data exfiltration. The vulnerability creates a particularly dangerous scenario because it leverages the elevated privileges of administrative accounts, allowing attackers to manipulate critical system configurations while maintaining stealth through the legitimate application interface. This threat vector aligns with ATT&CK technique T1059.007 for command and scripting interpreter and T1566.001 for spearphishing with attachments, as the stored XSS can be used to deliver malicious payloads that establish further compromise. The vulnerability's exploitation could result in complete administrative control over the Nessus application, potentially enabling attackers to view, modify, or delete scan results and configuration data.
Mitigation strategies for CVE-2024-0955 should focus on implementing robust input validation and output encoding mechanisms within the Nessus application's proxy configuration handling. Organizations should immediately apply vendor patches or updates that address the stored XSS vulnerability in proxy settings management. Network segmentation and privileged access controls should be reinforced to limit administrative access to the Nessus application, reducing the attack surface for potential exploitation. Regular security assessments should include testing for similar stored XSS vulnerabilities in other application components, as the underlying architectural flaw may exist in other areas of the system. The implementation of web application firewalls and content security policies can provide additional layers of protection against malicious script injection attempts. Security monitoring should be enhanced to detect anomalous proxy configuration changes, and regular audits of administrative activities should be conducted to identify potential unauthorized modifications that could indicate exploitation attempts.