CVE-2022-0130 An insecure Tenable version 5.14.0-5.19.1 was prone to a remote code execution vulnerability.

CVE-2022-0130 An insecure Tenable version 5.14.0-5.19.1 was prone to a remote code execution vulnerability.

The attacker would then have to send a carefully crafted request to the vulnerable Tenable.sc instance. When the server received the request, it would check the request against its blacklist configuration and if the request matched any of the blacklisted file types, it would respond with a 403 Unauthorized error code. The attacker could then send a modified request to the vulnerable instance, which would be accepted if the server was configured to allow the file type. If the server was configured to block the file type, the server would respond with an error code of 404 Not Found. The attacker would then receive a response containing arbitrary system commands that could be executed by the server.

Vulnerable Package

The vulnerable package is Tenable.sc, which is a software package that allows enterprises to manage and access their infrastructure remotely.

Vulnerable endpoint

The vulnerable endpoint was the Tenable.sc instance that received the request and responded with a 403 Unauthorized error code.

CVE-2023-0131

If the vulnerable instance is configured to block the file type, it would respond with an error code of 404 Not Found. The attacker would then receive a response containing arbitrary system commands that could be executed by the server.

Testing Methodology:

One of the key components in testing a vulnerability is being able to confirm that the vulnerability is present. In order to do so, it is important to verify that the vulnerable instance will accept a malicious request and execute any system commands.

Conclusion

A vulnerable package and an endpoint are identified. A methodology for testing is laid out that includes identifying vulnerable packages, testing them, and compiling a list of vulnerable endpoints.

References

Subscribe to CVE.news
Don’t miss out on the latest issues. Sign up now to get access to the library of members-only issues.
jamie@example.com
Subscribe