CVE-2025-36631

Executive Summary

CVE-2025-36631 is a high-severity local privilege escalation vulnerability affecting Tenable Agent on Windows hosts prior to version 10.8.5. The flaw allows a non-administrative user to overwrite arbitrary local system files with log content at SYSTEM privilege level. This is achieved through an insecure file operation (CWE-59: Improper Link Resolution Before File Access, also known as a symlink following or time-of-check time-of-use vulnerability). An attacker with low-privileged access can exploit this to corrupt critical system files, potentially leading to denial of service, data corruption, or further privilege escalation. The CVSS score is 8.4 (High), with a local attack vector and low attack complexity. No public exploit code or proof-of-concept is currently available, and the EPSS score is 0.0%, indicating low exploitation likelihood in the wild. The vendor has released a patched version (10.8.5) to address this issue.

Supply Chain & Package Security

This vulnerability is not related to an open-source package manager (NPM, PyPI, Go, Ruby). It affects a proprietary Windows agent from Tenable. Therefore, supply chain security considerations are limited to ensuring the integrity of the Tenable Agent installer and verifying digital signatures during deployment.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:N/I:H/A:H
• Base Score: 8.4 (High)
• Attack Vector (AV): Local (L) – The attacker must have local access to the Windows host.
• Attack Complexity (AC): Low (L) – No special conditions or race conditions are required beyond standard file system access.
• Privileges Required (PR): Low (L) – The attacker needs only a non-administrative user account.
• User Interaction (UI): None (N) – No user action is required beyond the attacker’s own actions.
• Scope (S): Changed (C) – The vulnerable component (Tenable Agent) impacts resources beyond its security scope (system files).
• Confidentiality (C): None (N) – No direct data disclosure.
• Integrity (I): High (H) – Arbitrary system files can be overwritten, compromising system integrity.
• Availability (A): High (H) – Overwriting critical system files can cause denial of service.

Threat Level: High. The vulnerability allows a low-privileged attacker to corrupt system files at the highest privilege level (SYSTEM). While local access is required, the impact on integrity and availability is severe.

Deep Dive & Mechanics

The vulnerability resides in the Tenable Agent’s logging mechanism on Windows. The agent runs as a Windows service with SYSTEM privileges. When generating log files, it performs file write operations without properly validating symbolic links or file paths. A non-administrative user can create a symbolic link (symlink) or a hard link pointing from the expected log file location to a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts, C:\Windows\System32\config\SAM, or a DLL in System32). When the agent writes log data, it follows the link and overwrites the target file with log content. Since the agent runs as SYSTEM, the overwrite occurs at the highest privilege level.

Key Technical Details:

• Vulnerable Component: Tenable Agent logging subsystem (likely tenable_agent.exe or a related DLL).
• Attack Vector: Local, low-privileged user.
• Prerequisite: The attacker must have write access to the directory where the agent writes logs (e.g., C:\ProgramData\Tenable\Agent\logs\ or similar). By default, non-administrators may have write access to ProgramData subdirectories.
• Exploitation Steps:
  1. Identify the log file path used by the Tenable Agent (e.g., C:\ProgramData\Tenable\Agent\logs\agent.log).
  2. Delete or rename the existing log file.
  3. Create a symbolic link from the log file path to a target system file (e.g., C:\Windows\System32\drivers\etc\hosts).
  4. Trigger log generation (e.g., by causing a scan or error).
  5. The agent writes log data to the target file, overwriting it with log content.

Impact: Overwriting system files can lead to:

• Denial of service (e.g., corrupting boot configuration).
• Privilege escalation (e.g., replacing a system DLL with a malicious one, though log content is plaintext, so this is limited).
• Data corruption (e.g., overwriting the SAM database to lock out users).

Vulnerable vs. Patched Code

Since the exact source code is proprietary, the following is a conceptual comparison based on the vulnerability type.

Vulnerable Code (Conceptual):

// Pseudocode for vulnerable logging
void write_log(const char* message) {
    FILE* log_file = fopen("C:\\ProgramData\\Tenable\\Agent\\logs\\agent.log", "a");
    if (log_file) {
        fprintf(log_file, "%s\n", message);
        fclose(log_file);
    }
}

The code does not check if the file path is a symbolic link or if it points outside the intended directory.

Patched Code (Conceptual):

// Pseudocode for patched logging
void write_log(const char* message) {
    // Use a secure file path with proper permissions
    HANDLE hFile = CreateFile(
        L"C:\\ProgramData\\Tenable\\Agent\\logs\\agent.log",
        FILE_APPEND_DATA,
        FILE_SHARE_READ,
        NULL,
        OPEN_ALWAYS,
        FILE_ATTRIBUTE_NORMAL | FILE_FLAG_OPEN_REPARSE_POINT, // Do not follow symlinks
        NULL
    );
    if (hFile != INVALID_HANDLE_VALUE) {
        // Write log data
        WriteFile(hFile, message, strlen(message), NULL, NULL);
        CloseHandle(hFile);
    }
}

The patched version uses FILE_FLAG_OPEN_REPARSE_POINT to prevent following symbolic links, or it validates the final target path against an allowlist.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows host with Tenable Agent < 10.8.5 installed.
• Low-privileged user account (e.g., user).
• Write access to the agent’s log directory (e.g., C:\ProgramData\Tenable\Agent\logs\).

Exploitation Steps:

1. Identify Log Path:

   # Check default log location
   dir "C:\ProgramData\Tenable\Agent\logs\"
   

2. Create Symbolic Link:

   # Delete existing log file (if any)
   del "C:\ProgramData\Tenable\Agent\logs\agent.log"
   
   # Create symlink to a critical system file (e.g., hosts file)
   mklink "C:\ProgramData\Tenable\Agent\logs\agent.log" "C:\Windows\System32\drivers\etc\hosts"
   

3. Trigger Log Generation:

   • Run a Tenable scan or restart the agent service.

   net stop "Tenable Agent"
   net start "Tenable Agent"
   

4. Verify Overwrite:

   type "C:\Windows\System32\drivers\etc\hosts"
   # The file will now contain log entries instead of original content.
   

Expected Outcome: The target system file is overwritten with log data, potentially causing system instability or denial of service.

Blue Team (Detection & Defense)

Detection:

• Monitor for creation of symbolic links by non-administrative users to paths under C:\ProgramData\Tenable\Agent\logs\.
• Alert on file integrity changes to critical system files (e.g., hosts, SAM, SYSTEM).
• Use Sysmon Event ID 1 (Process creation) for mklink or New-Item -ItemType SymbolicLink commands.

Defense:

• Restrict write permissions to the agent’s log directory to only the SYSTEM account and administrators.
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block symbolic link creation from untrusted processes.
• Deploy the patched version (10.8.5) immediately.

Indicators of Compromise (IOCs)

• File System:
  • Unexpected symbolic links in C:\ProgramData\Tenable\Agent\logs\ pointing to system files.
  • Modified critical system files (e.g., C:\Windows\System32\drivers\etc\hosts, C:\Windows\System32\config\SAM).
• Process:
  • cmd.exe or powershell.exe executing mklink or New-Item -ItemType SymbolicLink targeting the agent log directory.
• Event Logs:
  • Windows Security Event ID 4663 (An attempt was made to access an object) with AccessMask indicating write to system files.
  • Sysmon Event ID 1 for mklink execution.
  • Sysmon Event ID 11 (FileCreate) for new symbolic links.

Detection Engineering

YARA Rule

rule CVE_2025_36631_Tenable_Agent_Symlink_Overwrite {
    meta:
        description = "Detects symbolic link creation targeting Tenable Agent log directory"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-36631"
        hash = "d41d8cd98f00b204e9800998ecf8427e"
    strings:
        $s1 = "C:\\ProgramData\\Tenable\\Agent\\logs\\" ascii wide nocase
        $s2 = "mklink" ascii wide nocase
        $s3 = "New-Item" ascii wide nocase
        $s4 = "SymbolicLink" ascii wide nocase
    condition:
        (uint16(0) == 0x5a4d or uint16(0) == 0x4d5a) and // PE file
        all of ($s1, $s2, $s3, $s4)
}

Sigma Rule

title: CVE-2025-36631 - Tenable Agent Symlink Overwrite
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of symbolic links to Tenable Agent log directory by non-admin users
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2025-36631
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith:
            - '\cmd.exe'
            - '\powershell.exe'
        CommandLine|contains:
            - 'mklink'
            - 'New-Item'
        CommandLine|contains: 'C:\ProgramData\Tenable\Agent\logs\'
    condition: selection
falsepositives:
    - Legitimate administrative actions
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2025-36631 - Tenable Agent Symlink Overwrite Attempt"; flow:to_server,established; content:"mklink"; nocase; content:"C:\\ProgramData\\Tenable\\Agent\\logs\\"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Tenable Agent: Update to version 10.8.5 or later. This is the only complete fix.
2. Restrict Log Directory Permissions: Ensure only SYSTEM and administrators have write access to C:\ProgramData\Tenable\Agent\logs\.
3. Monitor for Symlink Creation: Deploy detection rules (YARA, Sigma, Suricata) to alert on suspicious symlink creation.

Long-Term Mitigations:

• Implement file integrity monitoring (FIM) for critical system files.
• Use Windows Defender ASR rules to block untrusted processes from creating symbolic links.
• Apply the principle of least privilege to all user accounts.

Workaround (if patching is delayed):

• Disable the Tenable Agent service temporarily, or configure it to run under a lower-privileged account (though this may break functionality).

Valters IT