Critical Nessus Agent Windows Flaw (CVE-2024-XXXX) Lets Attackers Run Code as SYSTEM

Key Takeaways

• A critical privilege escalation flaw (CVE-2024-XXXX) has been discovered in Tenable Nessus Agent for Windows.
• The vulnerability allows local attackers to achieve arbitrary code execution with SYSTEM privileges, the highest level of access on Windows systems.
• This affects organizations using Nessus Agents on Windows for vulnerability scanning across their endpoints.
• Tenable has released a patch in Nessus Agent version 11.1.3, urging immediate upgrades.

A significant security flaw has been identified in Tenable’s Nessus Agent for Windows, posing a severe risk to enterprise environments. This vulnerability, tracked as CVE-2024-XXXX, could enable an attacker to execute arbitrary code with SYSTEM privileges, effectively granting complete control over an affected machine.

The core of the issue lies in the agent’s handling of Windows file system junctions. These symbolic links, when improperly managed by a privileged process, can be exploited to delete critical system files. Once this high-privilege file deletion is achieved, it creates a pathway for an attacker to inject and execute malicious code, escalating their access to the highest possible level within the operating system.

Nessus Agent Vulnerability on Windows Explained

The vulnerability capitalizes on a well-known class of privilege escalation techniques often referred to as a “symlink attack” or “junction abuse.” On Windows systems, NTFS junctions function as redirects, transparently sending file system operations from one directory to another. When a high-privilege process, such as the Nessus Agent service, performs file operations without adequate validation, it can be tricked into interacting with unintended targets.

An attacker with local access can strategically place a malicious junction in a location that the Nessus Agent service routinely accesses. By manipulating the agent’s file deletion routines to target sensitive system files or directories, the attacker can disrupt the operating environment. This controlled corruption then opens a window for the attacker to introduce and execute a malicious payload under the SYSTEM context.

Achieving SYSTEM privileges is particularly dangerous because it bypasses all other user account controls, including standard administrator accounts. Code running with SYSTEM access can modify any file, install rootkits, disable security software, and maintain persistence across reboots without hindrance, making it a highly sought-after target for malicious actors.

This vulnerability specifically impacts Nessus Agent installations operating on Windows platforms. Enterprises that rely on Nessus Agents for continuous vulnerability scanning across their endpoints are directly exposed to this risk. Given that these agents are frequently deployed on critical servers and sensitive workstations, a successful exploit could have profound and detrimental consequences for an organization’s overall security posture.

What You Should Do

• Upgrade Immediately: Tenable has released Nessus Agent version 11.1.3, which contains the fix for this vulnerability. Organizations must prioritize upgrading all affected Nessus Agent installations on Windows without delay. The update is available via the Tenable Downloads Portal.
• Prioritize High-Value Assets: Pay particular attention to Nessus Agents installed on high-value servers, domain controllers, and internet-facing Windows systems, as these represent the greatest risk.
• Monitor for Anomalous Activity: Even after patching, maintain vigilance for any unusual activity on systems where Nessus Agents are deployed, as a precautionary measure.
• Report Suspected Vulnerabilities: Tenable encourages security teams and researchers to report any newly discovered vulnerabilities directly to them to facilitate rapid response and resolution.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.