Plugin Spotlight: Office Files List
Attackers have access to a great deal of public information about your organization. Public web sites, domain records, routing information and several other sources can provide an attacker with useful information to launch attacks. Public documents posted on your web site contain metadata that can be very useful to an attacker. Metadata, in the context of the documents created within your organization, is information about the document itself. This can include who created it, their email address, the creation date, the software used to create and publish it and the software version and platform. This information can then be used to create client-side attacks that specifically target individuals and the software they are using.
Nessus plugin 11419, Office files list, attempts to discover the documents that are located on the target web site. Currently this plugin checks for the following document types:
| *.doc | MS Word |
| *.wri | Write |
| *.xls | MS Excel |
| *.ppt | MS PowerPoint |
| *.csv | Generic Spreadsheet |
| *.dif | spreadsheet |
| *.rtf | Generic Word Processor |
| Adobe Acrobat PDF | |
| *.sxw | Open Office Writer |
| *.sxi | Open Office Presentation |
| *.sxc | Open Office Spreadsheet |
| *.sdw | StarWriter |
| *.sdd | StarImpress |
| *.sdc | StarCalc |
Running this plugin against web sites produces a report that lists each document and type found:
When performing vulnerability scans and assessments against your web servers, make sure you also examine the documents being distributed on the web server. Manual inspection is required to ensure that no sensitive information is contained within the document. A further step is required to ensure that document metadata has been removed. Periodic audits using Nessus, especially of your public facing web servers, will aid in the discovery of documents that may leak too much information to attackers. Plugin 11419 helps you find this information before the attackers do.You may also consider implementing a “Metadata Scrubber”, such as the Office add-in made freely available by Microsoft called “Remove hidden data”.
Resources
- "Document Metadata, The Silent Killer" Research Paper by Larry Pesce
- Office 2007 Metadata - Video tutorial on how to extract metadata from Office 2007 documents
- FOCA - An online or downloadable tool for extracting document metadata
Related Articles
Study: Tenable Offers Fastest, Broadest Coverage of CISA's KEV Catalog
October 23, 2023Tenable ranked first in multiple vulnerability management categories, including the most comprehensive coverage and quickest detection of CISA's Known Exploited Vulnerabilities, according to a Miercom report commissioned by Tenable.
Tuning Network Assessments for Performance and Resource Usage
September 13, 2022Using the correct tool for the job and optimizing scanner placement will have a large impact on scan efficiency with Nessus, Tenable.io and Tenable.sc.
Terrascan Joins the Nessus Community, Enabling Nessus To Validate Modern Cloud Infrastructures
May 17, 2022The addition of Terrascan to the Nessus family of products helps users better secure cloud native infrastructure by identifying misconfigurations, security weaknesses, and policy violations by scanning Infrastructure as Code repositories.
CloudImposer: Executing Code on Millions of Google Servers with a Single Malicious Package
September 16, 2024Tenable Research discovered a remote code execution (RCE) vulnerability in Google Cloud Platform (GCP) that is now fixed and that we dubbed CloudImposer. The vulnerability could have allowed an attacker to hijack an internal software dependency that Google pre-installs on each Google Cloud Composer pipeline-orchestration tool. Tenable Research also found risky guidance in GCP documentation that customers should be aware of.
Cybersecurity Snapshot: Russia-backed Hackers Aim at Critical Infrastructure Orgs, as Crypto Fraud Balloons
September 13, 2024Critical infrastructure operators must beware of Russian military hacking groups. Plus, cyber scammers are having a field day with crypto fraud. Meanwhile, AI and cloud vendors face stricter reporting regulations in the U.S. And get the latest on AI-model risk management and on cybersecurity understaffing!
Microsoft’s September 2024 Patch Tuesday Addresses 79 CVEs (CVE-2024-43491)
September 10, 2024Microsoft addresses 79 CVEs with seven critical vulnerabilities and four zero-day vulnerabilities, including three that were exploited in the wild.
- Nessus