Vulnerability Management Report

Prepared for: CyberTech Solutions

Prepared by: Victoria Simon

Date: April 10, 2024

---

1. Executive Summary

This report details the findings from a comprehensive vulnerability assessment conducted on CyberTech Solutions' Linux infrastructure and web applications using Nessus. The assessment included:

• Credentialed scans of Linux servers
• Web application vulnerability scans
• Automated reporting configuration
• Patch management via Ansible

Key findings include critical vulnerabilities in Nginx and outdated OpenSSH versions. Immediate patching and security hardening recommendations are provided.

---

2. Lab Objectives

1. Perform credentialed vulnerability scans on Linux systems.
2. Identify and analyze web application vulnerabilities.
3. Configure Nessus for automated email reporting.
4. Patch vulnerabilities using Ansible.
5. Document findings for stakeholder review.

---

3. Tools and Resources Used

---

4. Methodology

Task 1: Credentialed Scan Configuration

1. SSH Setup:

   • Installed OpenSSH (sudo apt install openssh-server).
   • Configured Nessus with SSH credentials (username: root, password: kali).
   • Enabled privilege escalation via su.

    

   

2. Scan Results:

scanned ssh vulnerability score

RECOMMENDATIONS Following the credentialed scan and vulnerability assessment on the Linux server and hosted applications, the following remediation steps are recommended to improve the organization’s security posture:

1. System and Software Patching: • Upgrade OpenSSH to the latest secure version to address known vulnerabilities. • Apply the latest Linux kernel patches, including urgent updates such as CVE-2022-0185. • Upgrade Node.js to version 18.20.1 or later to mitigate risks like request smuggling, insecure randomness, and memory management vulnerabilities (e.g., CVE-2024-27980, CVE-2024-21891, CVE-2024-21892). • Enable automatic patch updates or integrate with a centralized patch management system to ensure timely application of security fixes.
2. SSH Service Hardening • Disable weak SSH algorithms, ciphers (e.g., CBC, Arcfour), and MACs. • Enforce key-based authentication and disable password login where possible. • Configure custom SSH port and restrict SSH access using firewall rules or TCP wrappers. • Limit access to specific IPs and implement two-factor authentication (2FA) for remote connections.
3. User and Access Control • Disable root login via SSH; use sudo for privilege elevation. • Remove unused or legacy user accounts and enforce strong password policies. • Set up account lockout mechanisms to prevent brute-force attacks. • Audit user groups and privileges to ensure least privilege is enforced.
4. Host and Network Hardening • Disable unnecessary services and close unused ports. • Use hardening tools like Lynis, OpenSCAP, or CIS Benchmarks to enforce best practices. • Implement firewall rules to limit network exposure and prevent lateral movement.
5. Monitoring, Logging, and Detection • Enable detailed logging for SSH, sudo, and system events. • Integrate logs with a SIEM platform for real-time monitoring and alerting. • Monitor for suspicious behavior and anomalous access patterns.
6. Application and Dependency Security • Run npm audit or yarn audit to scan and fix Node.js dependencies. • Regularly test applications with dynamic and static analysis tools (DAST/SAST). • Use a Web Application Firewall (WAF) to block known web-based attacks.
7. Backup and Recovery • Schedule regular backups of configurations and critical data. • Test disaster recovery and backup restoration procedures periodically.
8. Security Awareness and Governance • Conduct regular security training for system administrators and developers. • Maintain updated security policies, procedures, and asset documentation. • Perform periodic vulnerability assessments and penetration tests to stay proactive.

Task 2: Web Application Scan

1. Nginx Vulnerabilities:

• CVE-2021-23017 (CVSS 7.5): Buffer overflow in Nginx 1.15.5.

  • Exploit: Remote DoS via crafted request.
  • Patch: Upgrade to Nginx ≥1.20.1.

• CVE-2022-41741 (CVSS 8.2): HTTP/2 memory corruption.

• CVE-2025- 2254

  • Exploit Available: Yes (Metasploit module).

1. Vulnerability Analysis:
   • Exploit Ease: Low complexity (public exploits available).
   • Patch Dates:
     • CVE-2021-23017: Patched June 2021.
     • CVE-2022-41741: Patched October 2022.

Task 3: Automated Email Reporting

1. SMTP Configuration:

   • Host: smtp.gmail.com (Port: 587, TLS).

   

   • Used Gmail app password for authentication.

   

   

   • Test email successfully sent to stakeholders.

   

   nessus sent an email. meaning, it worked perfectly.

Task 4: Patch Management

1. Ansible Playbook:

   • Removed outdated Nginx (/usr/local/nginx).
   • Installed latest Nginx version (apt: name=nginx state=latest).

   

   .yml script to update the old version of Nginx

   • Result: Upgraded from Nginx 1.15.5 to 1.26.3.

   

---

---

5. Analysis and Findings

Key Vulnerabilities Identified

1. Outdated NGINX Versions

• CVE-2021-23017: 1-byte memory overwrite in DNS resolver (risk: RCE/crashes).
• HTTP/2 Exploits:
  • CVE-2019-9511, CVE-2019-9513, CVE-2019-9516: DoS via frame manipulation.
  • CVE-2018-16843, CVE-2018-16844, CVE-2018-16845: CPU/memory exhaustion attacks.
• CVE-2019-20372: Server version disclosure via HTTP headers (information leakage).

2. Multiple Plugin Findings from Nessus

• Plugin IDs: 150154, 127907, 118956, 134220 confirm unsupported/vulnerable NGINX versions.

Key Risks:

• Unpatched systems are susceptible to ransomware and data breaches.
• Web vulnerabilities expose client data to interception.

6. Critical Actions for NGINX Security Remediation

1. Upgrade NGINX to Latest Stable Version (≥1.20.1)
   • Why? Mitigates:
     • CVE-2021-23017 (DNS resolver memory corruption)
     • HTTP/2 DoS vulnerabilities (CVE-2019-9511, CVE-2018-16843, etc.)
     • Server version disclosure (CVE-2019-20372).
   • Action:
     • Backup configurations (nginx.conf), then upgrade using official NGINX repositories.
     • Verify version post-upgrade: nginx -v.
2. Disable or Harden HTTP/2
   • If HTTP/2 is unnecessary:
     • Disable in NGINX config (listen 443 ssl instead of listen 443 ssl http2).
   • If required:
     • Ensure NGINX is patched (post-upgrade).
     • Monitor logs for anomalous HTTP/2 traffic (e.g., rapid streams/frames).
3. Implement Patch Management
   • Automate updates: Use tools like unattended-upgrades (Linux) or Ansible.
   • Schedule audits: Monthly checks for NGINX/OS package updates.
4. Verify Fixes with Nessus Rescan
   • Re-run Nessus (Plugin IDs: 150154, 127907, etc.) to confirm:
     • NGINX version no longer flagged.
     • HTTP/2 CVEs (if enabled) are patched.

Additional Hardening Steps

• Hide NGINX version: Add server_tokens off; in nginx.conf.
• Limit HTTP Methods: Allow only GET, POST, HEAD if applicable.
• Monitor CVE Databases: Subscribe to NGINX security advisories.

Timeline:

• Immediate (24-48h): Upgrade NGINX, disable HTTP/2 (if possible).
• Follow-up (1 week): Patch management rollout + rescan.

Post-Remediation: Document changes and update incident response plans to include HTTP/2/NGINX exploit scenarios.

---

7. Challenges and Solutions

---

8. Conclusion

The assessment identified critical vulnerabilities in CyberTech’s web infrastructure due to outdated NGINX versions and unpatched CVEs, exposing the organization to DoS attacks, memory corruption, and information disclosure. To address these risks, immediate upgrades, HTTP/2 hardening, and automated patch management are essential.

A follow-up scan should be conducted post-remediation to validate fixes. Sustaining a proactive security posture through regular updates and monitoring will help mitigate future threats and ensure long-term resilience.

---

10. References

1. NIST NVD: https://nvd.nist.gov
2. Nessus Documentation: https://www.tenable.com
3. https://www.notion.so/Nessus-1cb5f18a0bc980cdb558d62702ab23e9?pvs=4