CVE-2025-36630

Executive Summary

CVE-2025-36630 is a high-severity local privilege escalation vulnerability affecting Tenable Nessus versions prior to 10.8.5 on Windows hosts. The flaw allows a non-administrative user to overwrite arbitrary local system files with log content at SYSTEM privilege level. This is achieved through improper handling of file permissions and symbolic links (CWE-59), enabling an attacker to escalate privileges from a standard user to SYSTEM. The vulnerability has a CVSS score of 8.4, indicating significant impact on confidentiality, integrity, and availability. No public proof-of-concept or exploit code is currently available, but the risk is elevated due to the widespread deployment of Nessus in enterprise environments.

CVSS Breakdown & Threat Level

• CVSS Score: 8.4 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H
• Attack Vector: Local (AV:L) – requires local access to the Windows host.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: Low (PR:L) – attacker needs only a non-administrative user account.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Changed (S:C) – vulnerability can affect resources beyond the original security scope.
• Confidentiality Impact: High (C:H) – potential to read SYSTEM-level files.
• Integrity Impact: High (I:H) – ability to overwrite system files.
• Availability Impact: High (A:H) – could lead to system instability or denial of service.

Threat Level: Critical for environments where Nessus runs on Windows with standard user access. The lack of public exploit code reduces immediate risk, but the vulnerability is easily exploitable once discovered.

Deep Dive & Mechanics

The vulnerability resides in the Nessus logging mechanism on Windows. Nessus runs as a Windows service with SYSTEM privileges. When logging events, it writes to log files in a directory that is writable by non-administrative users (e.g., C:\ProgramData\Tenable\Nessus\logs). The flaw involves improper handling of symbolic links (CWE-59). A non-admin user can create a symbolic link from a legitimate log file to a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts or a DLL). When Nessus writes log data, it follows the symlink and overwrites the target file with SYSTEM privileges.

Attack Flow:

1. Attacker gains local access as a standard user.
2. Attacker identifies a log file path that Nessus writes to (e.g., nessusd.messages).
3. Attacker deletes the original log file and creates a symbolic link pointing to a target system file (e.g., C:\Windows\System32\some.dll).
4. Nessus service writes log data to the symlink, overwriting the target file with SYSTEM privileges.
5. Attacker can then trigger a system reboot or service restart to load the modified file, achieving privilege escalation or persistence.

Root Cause: The Nessus service does not validate that the target file is a regular file within the expected directory before writing. It also does not drop privileges when writing logs.

Vulnerable vs. Patched Code

Vulnerable (pre-10.8.5):

• The logging function uses CreateFile or fopen without checking for reparse points.
• No use of FILE_FLAG_OPEN_REPARSE_POINT or FILE_ATTRIBUTE_NORMAL to prevent symlink traversal.
• Example pseudo-code:

  HANDLE hFile = CreateFile(logPath, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_ATTRIBUTE_NORMAL, NULL);
  // No check for symbolic link
  WriteFile(hFile, logData, ...);
  

Patched (10.8.5+):

• The logging function now uses CreateFile with FILE_FLAG_OPEN_REPARSE_POINT to open the symlink itself, not the target.
• Alternatively, it uses GetFinalPathNameByHandle to verify the resolved path is within the allowed log directory.
• Example pseudo-code:

  HANDLE hFile = CreateFile(logPath, GENERIC_WRITE, FILE_SHARE_READ, NULL, OPEN_ALWAYS, FILE_FLAG_OPEN_REPARSE_POINT | FILE_ATTRIBUTE_NORMAL, NULL);
  // Check if file is a symlink
  if (GetFileInformationByHandleEx(hFile, FileStandardInfo, ...)) {
      // Reject if symlink
  }
  

Exploitation & Lab Setup

Red Team

Lab Environment:

• Windows 10/11 or Windows Server 2019/2022.
• Nessus version 10.8.4 or earlier installed as a service.
• A standard user account (non-admin).

Exploitation Steps:

1. Log in as a standard user.
2. Identify the Nessus log directory: C:\ProgramData\Tenable\Nessus\logs\.
3. Determine a log file that is regularly written to (e.g., nessusd.messages).
4. Stop the Nessus service temporarily (if possible) or wait for a log rotation.
5. Delete the target log file: del C:\ProgramData\Tenable\Nessus\logs\nessusd.messages.
6. Create a symbolic link to a critical system file (e.g., a DLL in C:\Windows\System32\):

   mklink C:\ProgramData\Tenable\Nessus\logs\nessusd.messages C:\Windows\System32\drivers\etc\hosts
   

7. Restart the Nessus service or trigger a log write (e.g., by performing a scan).
8. The hosts file is overwritten with log content, potentially redirecting traffic.
9. For DLL hijacking, overwrite a system DLL and reboot to gain code execution as SYSTEM.

Note: No public exploit code is available. The above is a theoretical exploitation path based on the vulnerability description.

Blue Team

Detection:

• Monitor for creation of symbolic links in C:\ProgramData\Tenable\Nessus\logs\ by non-admin users.
• Alert on file deletion events in the Nessus log directory.
• Use Sysmon Event ID 1 (Process creation) for mklink commands.
• Monitor for unusual file writes to system directories (e.g., C:\Windows\System32\).

Prevention:

• Apply the patch by upgrading to Nessus 10.8.5 or later.
• Restrict write permissions on the Nessus log directory to only the SYSTEM account and administrators.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from untrusted processes.
• Use AppLocker or WDAC to prevent execution of mklink by standard users.

Indicators of Compromise (IOCs)

• File System:

  • Symbolic links in C:\ProgramData\Tenable\Nessus\logs\ pointing outside the directory.
  • Unexpected file modifications in C:\Windows\System32\ or C:\Windows\System32\drivers\etc\.
  • Presence of log content in non-log files (e.g., hosts file containing Nessus log entries).

• Process:

  • nessusd.exe writing to files outside its expected log directory.
  • cmd.exe or powershell.exe executing mklink with non-admin privileges.

• Event Logs (Windows):

  • Security Event ID 4663 (An attempt was made to access an object) with ACCESS_MASK indicating write to system files.
  • Sysmon Event ID 1 for mklink execution.
  • Sysmon Event ID 11 (FileCreate) for symlink creation in the log directory.

• Network:

  • Unusual DNS queries if hosts file is overwritten to redirect traffic.

Detection Engineering

YARA Rule

rule CVE_2025_36630_Nessus_Symlink_Exploit {
    meta:
        description = "Detects symbolic link creation in Nessus log directory pointing to system files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-36630"
    strings:
        $symlink_cmd = "mklink" nocase
        $nessus_log_dir = "C:\\ProgramData\\Tenable\\Nessus\\logs" nocase
        $system_path = "C:\\Windows\\System32" nocase
    condition:
        $symlink_cmd and $nessus_log_dir and $system_path
}

Sigma Rule

title: Nessus Symlink Privilege Escalation Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symbolic links in Nessus log directory by non-admin users
author: Valters IT
date: 2025/04/10
references:
    - CVE-2025-36630
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        CommandLine|contains: 'mklink'
        CommandLine|contains: 'C:\ProgramData\Tenable\Nessus\logs'
    condition: selection
falsepositives:
    - Legitimate administrative actions (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-36630 Nessus Symlink Exploit - Potential Data Exfiltration"; flow:to_server,established; content:"nessusd"; nocase; content:"log"; nocase; within:100; reference:cve,2025-36630; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Patch: Upgrade Tenable Nessus to version 10.8.5 or later on all Windows hosts. This is the only complete fix.
2. Workaround: If patching is not immediately possible, restrict write permissions on C:\ProgramData\Tenable\Nessus\logs\ to only the SYSTEM account and local administrators. Remove Users or Everyone write access.
3. Monitor: Enable auditing on the Nessus log directory to detect unauthorized file deletions or symlink creation.

Long-Term Mitigations:

• Implement the principle of least privilege for all services.
• Use Windows Defender Application Control (WDAC) to block untrusted binaries.
• Regularly review and harden service account permissions.
• Deploy endpoint detection and response (EDR) solutions with behavioral analytics.

Valters IT Signature This report was generated by Valters IT DevSecOps AI. All information is provided for authorized security testing and defense purposes only.