How to remediate – Tenable PVS Proxy Detection

1. Introduction

Tenable PVS Proxy Detection indicates a Tenable PVS Proxy service is running on a host. This can create an unnecessary attack surface, allowing remote access to the proxy service itself. Systems typically affected are those where Tenable products have been installed and configured with proxy settings. A successful exploit could allow unauthorised access or modification of proxy configurations, impacting confidentiality, integrity, and availability.

2. Technical Explanation

The vulnerability occurs when a Tenable PVS Proxy service is exposed without appropriate restrictions on incoming traffic. An attacker can potentially connect to the proxy service remotely. There isn’t a specific CVE associated with this detection as it’s more of a configuration issue than a software flaw. For example, an attacker could attempt to use the proxy to relay requests or gain access to internal resources. Affected systems include those running Tenable Nessus Network Monitor with PVS Proxy enabled.

• Root cause: The PVS Proxy service is listening on a network interface without sufficient firewall rules or access controls.
• Exploit mechanism: An attacker sends requests to the proxy service’s port, potentially bypassing intended security measures if not properly configured.
• Scope: Tenable Nessus Network Monitor with PVS Proxy enabled.

3. Detection and Assessment

You can confirm this vulnerability by checking for the running PVS Proxy service and its network accessibility. A quick check involves listing listening ports, while a thorough method uses network scanning tools.

• Quick checks: Use netstat -tulnp to list listening ports and identify the PVS Proxy process.
• Scanning: Nessus Network Monitor can detect this issue using its default vulnerability scans.
• Logs and evidence: Review system logs for entries related to the PVS Proxy service startup or network connections on the relevant port.

netstat -tulnp | grep pvs

4. Solution / Remediation Steps

To fix this issue, limit incoming traffic to the Tenable PVS Proxy port if it is not required for external access. If unused, disable the service entirely.

4.1 Preparation

• Ensure you have appropriate permissions to modify firewall rules or service configurations. A roll back plan involves restoring from the snapshot or re-enabling the service.
• A change window may be needed depending on your environment and impact assessment. Approval from a system owner might be required.

4.2 Implementation

1. Step 1: Identify the port used by the PVS Proxy service (typically, but not always, 8080).
2. Step 2: Configure your firewall to allow only necessary traffic to that port. For example, restrict access to specific IP addresses or networks.
3. Step 3: If the proxy is unused, stop the PVS Proxy service using systemctl stop tenable-pvs-proxy (or equivalent for your OS).

4.3 Config or Code Example

Before

#Example iptables rule allowing all traffic on port 8080
iptables -A INPUT -p tcp --dport 8080 -j ACCEPT

After

#Example iptables rule allowing only specific IP address to access port 8080
iptables -A INPUT -s 192.168.1.100 -p tcp --dport 8080 -j ACCEPT
iptables -A INPUT -p tcp --dport 8080 -j DROP

4.4 Security Practices Relevant to This Vulnerability

Several security practices can help prevent this issue. Least privilege reduces the impact of exploitation, while network segmentation limits access to sensitive services.

• Practice 1: Implement least privilege by only granting necessary permissions to users and services.
• Practice 2: Use network segmentation to isolate critical systems and limit lateral movement in case of a breach.

4.5 Automation (Optional)

#Example Ansible playbook snippet to restrict access via firewall
- name: Restrict PVS Proxy Access
  iptables:
    chain: INPUT
    protocol: tcp
    destination_port: 8080
    jump: DROP
    state: present

5. Verification / Validation

Confirm the fix by checking firewall rules and verifying that only allowed traffic can reach the PVS Proxy service. A negative test involves attempting to connect from an unauthorized host.

• Post-fix check: Use iptables -L INPUT to confirm the new firewall rule is in place.
• Re-test: Re-run the netstat -tulnp | grep pvs command and attempt a connection from an unauthorized host to verify access is blocked.
• Smoke test: Ensure that any legitimate users or systems still able to connect through the proxy can do so without interruption.
• Monitoring: Monitor firewall logs for dropped connections on port 8080, which could indicate attempted unauthorised access.

iptables -L INPUT | grep 8080

6. Preventive Measures and Monitoring

Update security baselines to include restrictions on unnecessary services like PVS Proxy. Implement CI/CD pipeline checks to prevent similar misconfigurations in the future.

• Baselines: Update your security baseline or policy to require firewall rules for all exposed network ports, including those used by Tenable products.
• Asset and patch process: Review system configurations regularly during asset management cycles to identify and address potential vulnerabilities.

7. Risks, Side Effects, and Roll Back

Restricting access could disrupt legitimate users if not configured correctly. Incorrect firewall rules can block necessary traffic. A roll back involves removing the new firewall rule or re-enabling the PVS Proxy service.

• Roll back: Step 1: Remove the added iptables rule using iptables -D INPUT ... (replace “…” with the original rule). Step 2: If disabled, re-enable the PVS Proxy service using systemctl start tenable-pvs-proxy.

8. References and Resources

• Vendor advisory or bulletin: https://www.tenable.com/products/nessus/nessus-network-monitor