CVE-2025-36633

Executive Summary

CVE-2025-36633 is a high-severity local privilege escalation vulnerability affecting Tenable Agent versions prior to 10.8.5 on Windows hosts. The flaw allows a non-administrative user to arbitrarily delete local system files with SYSTEM privilege, potentially leading to full system compromise. The vulnerability has a CVSS score of 8.8, indicating critical risk. No public proof-of-concept (PoC) or exploit code has been released as of this report. The vendor has not yet released an official patch, but upgrading to version 10.8.5 is recommended.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a native Windows application vulnerability.

CVSS Breakdown & Threat Level

• CVSS Score: 8.8 (High)
• Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Attack Vector: Local (AV:L)
• Attack Complexity: Low (AC:L)
• Privileges Required: Low (PR:L)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: High (I:H)
• Availability Impact: High (A:H)

Threat Level: Critical. The vulnerability allows a low-privileged user to delete arbitrary system files, which can lead to denial of service, data destruction, or privilege escalation.

Deep Dive & Mechanics

The vulnerability resides in the Tenable Agent service running on Windows. The service operates with SYSTEM privileges but fails to properly validate file paths provided by non-administrative users. By exploiting a symbolic link (symlink) or junction point, an attacker can trick the agent into deleting a system file (e.g., C:\Windows\System32\config\SAM) instead of the intended temporary file.

Root Cause: The agent uses a function like DeleteFile() on a path supplied by a low-privileged user without checking if the path is a symlink pointing to a protected system location.

Attack Flow:

1. Attacker creates a symlink from a writable directory (e.g., C:\Users\Public\Temp\target.tmp) to a critical system file (e.g., C:\Windows\System32\drivers\etc\hosts).
2. Attacker triggers the Tenable Agent to delete the file at the symlink path.
3. The agent, running as SYSTEM, follows the symlink and deletes the target system file.
4. This can cause system instability, denial of service, or be used as a stepping stone for privilege escalation (e.g., deleting a DLL to force a service to load a malicious one).

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

// Vulnerable: No symlink check
void DeleteTempFile(char *userPath) {
    char fullPath[MAX_PATH];
    sprintf(fullPath, "C:\\ProgramData\\Tenable\\Agent\\tmp\\%s", userPath);
    DeleteFile(fullPath);  // Follows symlinks
}

Patched Code (Conceptual):

// Patched: Check for symlinks before deletion
void DeleteTempFile(char *userPath) {
    char fullPath[MAX_PATH];
    sprintf(fullPath, "C:\\ProgramData\\Tenable\\Agent\\tmp\\%s", userPath);
    
    // Check if the final path is a symlink
    HANDLE hFile = CreateFile(fullPath, GENERIC_READ, FILE_SHARE_READ, NULL, OPEN_EXISTING, FILE_FLAG_OPEN_REPARSE_POINT, NULL);
    if (hFile != INVALID_HANDLE_VALUE) {
        // It's a reparse point (symlink/junction) - reject
        CloseHandle(hFile);
        return;
    }
    
    DeleteFile(fullPath);
}

Exploitation & Lab Setup

Red Team

Prerequisites:

• Windows host with Tenable Agent < 10.8.5
• Low-privileged user account
• Ability to create symlinks (requires SeCreateSymbolicLinkPrivilege, often granted to all users)

Exploitation Steps:

1. Identify a writable directory used by the agent (e.g., C:\ProgramData\Tenable\Agent\tmp\).
2. Create a symlink:

   mklink C:\ProgramData\Tenable\Agent\tmp\evil.tmp C:\Windows\System32\drivers\etc\hosts
   

3. Trigger the agent to delete the file (e.g., by initiating a scan or update that cleans temporary files).
4. Verify deletion of hosts file.

Note: No public exploit code is available. This is a conceptual demonstration.

Blue Team

Detection:

• Monitor for creation of symlinks in C:\ProgramData\Tenable\Agent\tmp\ by non-administrative users.
• Alert on deletion of critical system files (e.g., hosts, SAM, SYSTEM).
• Use Sysmon Event ID 1 (Process creation) to detect mklink usage.

Hunting Query (KQL):

DeviceProcessEvents
| where FileName == "cmd.exe" and ProcessCommandLine contains "mklink"
| where ProcessCommandLine contains "Tenable"

Indicators of Compromise (IOCs)

• File Paths:
  • C:\ProgramData\Tenable\Agent\tmp\*.tmp (symlink targets)
  • C:\Windows\System32\drivers\etc\hosts (deleted)
  • C:\Windows\System32\config\SAM (deleted)
• Processes:
  • TenableAgent.exe (running as SYSTEM)
• Registry Keys:
  • HKLM\SOFTWARE\Tenable\Agent (version info)
• Network:
  • Outbound connections to Tenable cloud (normal agent behavior)

Detection Engineering

YARA Rule

rule CVE_2025_36633_Tenable_Agent_Symlink_Deletion {
    meta:
        description = "Detects Tenable Agent versions vulnerable to CVE-2025-36633"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2025-36633"
    strings:
        $s1 = "TenableAgent.exe" ascii wide nocase
        $s2 = "10.8.5" ascii wide nocase
    condition:
        $s1 and not $s2
}

Sigma Rule

title: CVE-2025-36633 - Tenable Agent Symlink Deletion
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects creation of symlinks in Tenable Agent temp directory
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\cmd.exe'
        CommandLine|contains|all:
            - 'mklink'
            - 'Tenable'
    condition: selection
falsepositives:
    - Legitimate administrative use
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET $HTTP_PORTS (msg:"CVE-2025-36633 - Tenable Agent Outbound"; flow:to_server,established; content:"Tenable"; http_user_agent; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade Tenable Agent to version 10.8.5 or later.
2. Restrict the ability to create symlinks for non-administrative users (remove SeCreateSymbolicLinkPrivilege).
3. Monitor and audit file deletion events in C:\ProgramData\Tenable\Agent\tmp\.

Long-term:

• Implement file integrity monitoring (FIM) for critical system files.
• Apply principle of least privilege to all services.
• Regularly review vendor advisories and apply patches promptly.

Workaround: If upgrade is not possible, disable the agent's temporary file cleanup feature (if configurable) or use AppLocker to block mklink execution.

Valters IT