CVE-2025-36625

Executive Summary

CVE-2025-36625 is a medium-severity vulnerability affecting Tenable Nessus versions prior to 10.8.4. The flaw allows a non-authenticated attacker to manipulate Nessus logging entries by crafting malicious HTTP requests. This can lead to log injection, potentially obscuring malicious activity or causing false positives in security monitoring. The vulnerability has a CVSS score of 4.3, indicating a moderate risk. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, suggesting low exploitation activity. The vendor has released a fix in version 10.8.4.

Supply Chain & Package Security

This vulnerability is not related to a software supply chain or package manager (NPM, PyPI, Go, Ruby). It is a direct application-level flaw in Tenable Nessus.

CVSS Breakdown & Threat Level

• CVSS Score: 4.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
• Attack Vector (AV): Network (N) – The vulnerability can be exploited remotely.
• Attack Complexity (AC): Low (L) – No special conditions are required.
• Privileges Required (PR): None (N) – No authentication is needed.
• User Interaction (UI): None (N) – No user action is required.
• Scope (S): Unchanged (U) – The impact is confined to the vulnerable component.
• Confidentiality (C): None (N) – No data is exposed.
• Integrity (I): Low (L) – Log entries can be altered, affecting integrity.
• Availability (A): None (N) – No impact on system availability.

Threat Level: Medium. The low EPSS score and lack of public exploits reduce immediate risk, but the ability to inject false log entries can aid attackers in covering tracks or misleading incident response.

Deep Dive & Mechanics

The vulnerability resides in Nessus's HTTP request handling. Nessus listens on a web interface (typically port 8834) for management and scanning operations. When processing HTTP requests, the application logs request details (e.g., URI, headers, parameters) without proper sanitization. An attacker can inject newline characters (\r\n or \n) into log fields, causing the logging system to interpret subsequent text as new log entries. This allows the attacker to:

• Forge false log entries to simulate benign activity or hide malicious actions.
• Corrupt log structure, making analysis difficult.
• Inject malicious payloads that might be executed if logs are processed by other systems (e.g., SIEM parsers).

The root cause is improper input validation in the logging function. Nessus uses a standard logging library (e.g., Log4j or similar) that does not escape newline characters by default. The fix in version 10.8.4 likely involves sanitizing log inputs to remove or escape control characters.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

# Example of vulnerable logging in Nessus
def log_request(request):
    log_entry = f"Request: {request.method} {request.path} from {request.remote_addr}"
    logger.info(log_entry)

An attacker could send a request with a path like /valid-path\r\n[FAKE LOG ENTRY], causing the log to contain:

Request: GET /valid-path from 192.168.1.1
[FAKE LOG ENTRY]

Patched Code (Conceptual):

# Example of patched logging in Nessus
import re
def sanitize_log_input(text):
    # Remove or escape newline characters
    return re.sub(r'[\r\n]', '', text)

def log_request(request):
    safe_path = sanitize_log_input(request.path)
    log_entry = f"Request: {request.method} {safe_path} from {request.remote_addr}"
    logger.info(log_entry)

The patched version strips newline characters from the input before logging, preventing injection.

Exploitation & Lab Setup

Red Team (Attacker Perspective)

Prerequisites:

• Nessus instance running version < 10.8.4 (e.g., 10.8.3)
• Network access to the Nessus web interface (default port 8834)

Exploitation Steps:

1. Identify the Nessus web interface (e.g., https://target:8834).
2. Craft an HTTP request with a malicious payload in a loggable field (e.g., URI, User-Agent header).
3. Use curl to send the request:

   curl -k -X GET "https://target:8834/valid-path%0d%0a[FAKE%20LOG%20ENTRY]" -H "User-Agent: Mozilla/5.0"
   

   The %0d%0a represents URL-encoded \r\n.
4. Check the Nessus logs (e.g., /opt/nessus/var/nessus/logs/nessusd.messages) to confirm injection.

Expected Outcome: The log file will contain the injected entry, potentially misleading administrators.

Blue Team (Defender Perspective)

Detection Steps:

1. Monitor Nessus logs for unusual patterns, such as unexpected newlines or entries that do not match standard formats.
2. Use the Sigma rule provided in the Detection Engineering section to alert on suspicious log entries.
3. Verify Nessus version and ensure it is updated to 10.8.4 or later.
4. Review network logs for anomalous HTTP requests to the Nessus interface, especially those containing encoded newline characters.

Mitigation:

• Immediately upgrade to Nessus 10.8.4.
• Restrict network access to the Nessus web interface using firewalls or VPNs.
• Enable logging of all HTTP requests and correlate with Nessus logs.

Indicators of Compromise (IOCs)

• Log Entries: Unusual log entries containing newline characters or unexpected text.
• Network Traffic: HTTP requests to Nessus (port 8834) with URL-encoded newlines (%0d%0a, %0a) in the URI or headers.
• File Hashes: Nessus binary hashes for versions < 10.8.4 (if available from vendor).
• IP Addresses: Source IPs of suspicious requests (to be identified during investigation).

Detection Engineering

YARA Rule

rule CVE_2025_36625_Nessus_Log_Injection {
    meta:
        description = "Detects log injection attempts in Nessus logs"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-36625"
    strings:
        $newline = /[\r\n]/
        $nessus_log = "nessusd.messages"
    condition:
        $nessus_log and #newline > 0
}

Sigma Rule

title: Nessus Log Injection Attempt
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects attempts to inject newline characters into Nessus logs via HTTP requests
author: Valters IT
date: 2025/04/10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-36625
logsource:
    product: nessus
    service: nessusd
detection:
    selection:
        EventID: 1000  # Example event ID for HTTP request logging
        RequestPath|contains: 
            - '%0d%0a'
            - '%0a'
            - '\r\n'
            - '\n'
    condition: selection
falsepositives:
    - Legitimate use of newlines in rare cases (unlikely)
level: high

Suricata Rule

alert http $EXTERNAL_NET any -> $HOME_NET 8834 (msg:"CVE-2025-36625 Nessus Log Injection Attempt"; flow:to_server,established; content:"%0d%0a"; http_uri; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Nessus to version 10.8.4 or later. This is the only official fix.
2. Restrict network access to the Nessus web interface to trusted IPs only.
3. Review logs for signs of exploitation (unusual entries, newline characters).

Long-Term Measures:

• Implement input validation for all loggable fields in custom applications.
• Use a Web Application Firewall (WAF) to filter malicious HTTP requests.
• Regularly update Nessus and other security tools.
• Monitor CVEs and vendor advisories for similar vulnerabilities.

Workarounds (if upgrade is not immediately possible):

• Disable the Nessus web interface if not needed, and use CLI or API with strict access controls.
• Implement a reverse proxy that sanitizes HTTP requests before forwarding to Nessus.

Valters IT