CVE-2023-5622
📋 TL;DR
This vulnerability allows low-privileged Windows users to escalate privileges to SYSTEM level by replacing a specially crafted file in Nessus Network Monitor. It affects organizations running vulnerable versions of Tenable's Nessus Network Monitor on Windows systems. Attackers with initial access to a Windows host could gain full system control.
💻 Affected Systems
- Tenable Nessus Network Monitor
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of Windows host with SYSTEM privileges, enabling persistence, credential theft, lateral movement, and data exfiltration.
Likely Case
Privilege escalation from low-privileged user to SYSTEM on affected Windows hosts, allowing attackers to install malware, disable security controls, or access sensitive data.
If Mitigated
Limited impact if proper access controls prevent low-privileged users from accessing Nessus Network Monitor directories or if systems are patched.
🎯 Exploit Status
Exploitation requires local access and low-privileged user credentials. The vulnerability involves file replacement which is typically straightforward for attackers with appropriate access.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 6.2.1
Vendor Advisory: https://www.tenable.com/security/tns-2023-34
Restart Required: Yes
Instructions:
1. Download Nessus Network Monitor 6.2.1 from Tenable. 2. Stop the Nessus Network Monitor service. 3. Run the installer. 4. Restart the service. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Restrict file permissions
windowsApply strict file system permissions to prevent low-privileged users from accessing or modifying Nessus Network Monitor files.
icacls "C:\Program Files\Tenable\Nessus Network Monitor\" /deny Users:(OI)(CI)F
icacls "C:\ProgramData\Tenable\Nessus Network Monitor\" /deny Users:(OI)(CI)F
🧯 If You Can't Patch
- Implement strict access controls to prevent low-privileged users from accessing Nessus Network Monitor installation directories
- Monitor for suspicious file modification activities in Nessus Network Monitor directories using file integrity monitoring
🔍 How to Verify
Check if Vulnerable:
Check Nessus Network Monitor version via GUI or registry: HKEY_LOCAL_MACHINE\SOFTWARE\Tenable\Nessus Network Monitor\VersionCheck Version:
reg query "HKLM\SOFTWARE\Tenable\Nessus Network Monitor" /v VersionVerify Fix Applied:
Verify version is 6.2.1 or later and test that low-privileged users cannot modify Nessus Network Monitor files.📡 Detection & Monitoring
Log Indicators:
- Windows Security Event ID 4663 (File system access) showing low-privileged users accessing Nessus Network Monitor directories
- Unexpected service restarts or privilege escalation attempts
Network Indicators:
- Unusual outbound connections from Nessus Network Monitor host after privilege escalation
SIEM Query:
EventID=4663 AND ObjectName LIKE "%Nessus Network Monitor%" AND SubjectUserName NOT IN ("SYSTEM", "Administrators")