Building a Vulnerability Management Workflow with Nessus
Introduction
Vulnerability refers to a flaw in a system, application, or process that can be exploited by a threat actor to breach security. Therefore, vulnerability management is a critical component of proactive defense. It enables organizations to identify weaknesses in their systems, assess potential impact, and implement mitigation strategies before attackers can exploit them.
This project focuses on developing a structured cybersecurity workflow designed to identify and mitigate system vulnerabilities. The process begins with setting up a secure and controlled environment, followed by conducting vulnerability scans using Nessus Essentials, a widely used tool for detecting security flaws. These scans are enhanced through Secure Shell (SSH) authentication, which allows secure and credentialed access to target systems.
The final phase involves applying appropriate mitigation measures to strengthen system defenses and reduce exposure to potential threats. This workflow reflects industry best practices in vulnerability management and supports a proactive cybersecurity posture.
An outdated version of Nginx (v1.15.5) was intentionally installed on Linux to simulate a real-world vulnerable environment. After the vulnerabilities were discovered, patching was performed as part of the remediation phase.
Overall, this project bridges the gap between theoretical knowledge and practical application by integrating tool-based analysis with remediation strategies aligned with recognized cybersecurity standards such as ISO/IEC 27001 and NIST SP 800–40. The results reinforce the understanding that vulnerability management is not a one-time task but an ongoing cycle involving discovery, prioritization, mitigation, and validation.
Methodology and Tools Used
1. Nessus Essentials
Tenable Nessus Essentials served as the primary vulnerability scanning engine. It was installed and configured on a Kali Linux host to perform both credentialed and non-credentialed scans. Nessus detected weaknesses across system configurations, outdated software, and exposed web services. Its plugin-based architecture provided comprehensive coverage of known Common Vulnerabilities and Exposures (CVEs) and included CVSS scoring to help prioritize remediation efforts.
(A video guide on how to download and install Nessus on Kali Linux can be found here.)
2. Secure Shell (SSH)
SSH enables vulnerability scanners like Nessus to securely access target systems using valid credentials, allowing authenticated scans that offer deeper visibility into internal configurations and vulnerabilities.
To install SSH on your Linux terminal, run the following commands:
sudo apt update
sudo apt install ssh
Installing Dependencies and Downloading Nginx (Version 1.15.5)
An intentionally outdated version of Nginx 1.15.5 was downloaded, compiled, and installed on Kali Linux to create a vulnerable test environment.
This approach was done to:
- Identify known vulnerabilities associated with Nginx v1.15.5 and observe how they are flagged by Nessus.
- Interpret scan results, including CVE references, severity levels, and suggested remediations.
To download Nginx and its dependencies, use this command line:
wget http://nginx.org/download/nginx-1.15.5.tar.gz
This command retrieved the archive directly from the official Nginx repository.
Installing Dependencies
Before extracting and setting up Nginx, install the necessary build dependencies using the following commands:
sudo apt update
sudo apt install build-essential libpcre3 libpcre3-dev zlib1g zlib1g-dev libssl-dev
This package provided the essential libraries and tools required to compile and run Nginx.
Extracting the Nginx Package
Once the dependencies were installed, extract the downloaded archive using:
tar -zxvf nginx-1.15.5.tar.gz
This unpacked the source files, allowing us to prepare the environment for deployment.
Navigated into the extracted Nginx directory and compiled the source using the command line: cd nginx-1.15.5 ./configure make sudo make install
After the installation, start the service with the command sudo /usr/local/nginx/sbin/nginx
We used the command line sudo /usr/local/nginx/sbin/nginx -t to check status of the service
Confirm the version of nginx that was downloaded with this command: /usr/local/nginx/sbin/nginx -v
Simple Mail Transfer Protocol (SMTP)
To ensure that the results of the vulnerability scan will be sent via email after the scan.
● Configure SMTP for Email Reports:
● Go to Nessus Settings > SMTP Server.
● Set the SMTP Host to smtp.gmail.com.
● Set Encryption to TLS.
● Set the Port to 587.
Log in to your Gmail account.
● Go to your Google Account Settings.
● Under Security, ensure 2-Step Verification is enabled.
● Find and click on App Passwords.
● Create an app password specifically for Nessus.
● Copy the generated password.
● Enter your Gmail address as the username.
● Use the app password you generated as the password.
● Test the Configuration
Scanning
Start Nessus by running this command line: sudo systemctl start nessusd Once started, you can typically access the Nessus web interface at: https://localhost:8834
After selecting “my Scan”, select the new Scan tab. “Advanced Scan,” select “Credentials.” Configuring Credentials:
Choose SSH from the Credentials tab.
● Enter the username.
● Enter kali (for Kali Linux users).
● Select Su for Elevate Privileges.
● Create your own password.
● To determine the version of OpenSSH that is installed on your computer, use the ssh -V command. Then, enter that information in the scan configuration.
● Use the command line IP a to find your IP address.
After a few minutes the scan will be complete, and you will receive an email.
The result of the scan showed we identified 4 vulnerability
Documenting Identified Vulnerabilities under Nginx
Vulnerability 1 — [nginx 0.6.x < 1.20.1 1-Byte Memory Overwrite RCE]
A security issue in the Nginx resolver allows an unauthenticated remote attacker to cause a 1-byte memory overwrite by sending a specially crafted DNS response. This can result in a worker process crash or potentially arbitrary code execution.
● Exploit Availability and Exploit Details: Yes, Exploits are available; an attacker sends a malicious DNS response to Nginx’s resolver, triggering the memory overwrite vulnerability.
● Vulnerability ID: 150154
● Severity Level: High
● NIST Reference and CVSS Score / CVE: CVE-2021–23017 (CVSS v3.0 Base Score: 7.7)
● Patch Publication Date: May 25, 2021
● Vulnerability Publication Date: May 25, 2021
● NIST’s Description: According to NIST “A security issue in nginx resolver was identified, which might allow an attacker who is able to forge UDP packets from the DNS server to cause 1-byte memory overwrite, resulting in worker process crash or potential other impact”. NVD — CVE-2021–23017
Vulnerability 2 — [nginx 1.9.5 < 1.16.1 / 1.17.x < 1.17.3 ]
The installed version of Nginx (1.15.5) is affected by multiple denial of service vulnerabilities in the HTTP/2 protocol stack due to improper handling of exceptional conditions. These flaws allow unauthenticated remote attackers to crash the server by manipulating stream priorities, window sizes, or sending malformed headers.
● Exploit Availability and Exploit Details: No — Exploit code not publicly available. An attacker can exploit each sub-vulnerability using a distinct technique to trigger a denial-of-service condition.
● Vulnerability ID: 127907
● Severity Level: High
● NIST Reference and CVSS Score / CVE: Multiple Vulnerability
● Patch Publication Date: August 13, 2019
● Vulnerability Publication Date: August 13, 2019
● NIST’s Description: According to NIST, “Some HTTP/2 implementations are vulnerable to window size manipulation and stream prioritization manipulation, potentially leading to a denial of service. The attacker requests a large amount of data from a specified resource over multiple streams. They manipulate window size and stream priority to force the server to queue the data in 1-byte chunks. Depending on how efficiently this data is queued, which can consume excess CPU, memory, or both.” NVD — CVE-2019–9511
● Sub-vulnerability 1: CVE-2019–9511: DoS via manipulation of window size and stream priority.
Exploit Method: A remote attacker sends large data requests with crafted stream priorities.
CVSS v3.0 score: 7.5
● Sub-vulnerability 2: CVE-2019–9513: DoS via continual shuffling of stream priorities
Exploit Method: Remote attacker creates multiple streams and shuffles priorities to exhaust resources
CVSS v3.0 score: 7.5
Get Lilian Ugwu’s stories in your inbox
Join Medium for free to get updates from this writer.
● Sub-vulnerability 3: CVE-2019–9516 : DoS via zero-length header names and values
Exploit Method: Remote attacker sends malformed headers to crash the server
CVSS v3.0 Score: 7.5
Vulnerability 3 — [nginx 1.x < 1.14.1 / 1.15.x < 1.15.6]
The installed version of Nginx (1.15.5) is affected by multiple vulnerabilities due to unspecified errors i. These flaws allow excessive memory usage and excessive CPU usage and may lead to worker process crashes or memory disclosure.
● Exploit Availability and Exploit Details: No known exploits are available; an attacker can exploit each sub-vulnerability using a distinct technique to trigger resource exhaustion or instability in the server.
● Vulnerability ID: 118956
● Severity Level: Medium
● NIST Reference and CVSS Score / CVE: Multiple Vulnerability
● Patch Publication Date: November 6, 2018
● Vulnerability Publication Date: January 6, 2018
● NIST’s Description: According to NIST, “nginx before versions 1.15.6 and 1.14.1 has a vulnerability in the implementation of HTTP/2 that can allow for excessive memory consumption. This issue affects nginx compiled with the ngx_http_v2_module (not compiled by default) if the ‘http2’ option of the ‘listen’ directive is used in a configuration file.” NVD — CVE-2018–16843
● Sub-vulnerability 1: CVE-2018–16843: Excessive memory usage via ngx_http_v2_module
Exploit Method: An attacker interacts with the HTTP/2 module in a way that causes the server to consume excessive memory, potentially leading to resource exhaustion.
CVSS v3.0 Score: 6.1
● Sub-vulnerability 2: CVE-2018–16844: Excessive CPU usage via ngx_http_v2_module
Exploit Method: An attacker sends crafted HTTP/2 requests that trigger high CPU consumption, degrading server performance.
CVSS v3.0 Score: 6.1
● Sub-vulnerability 3: CVE-2018–16845: Worker process crashes or memory disclosure via ngx_http_mp4_module’
Exploit Method: An attacker exploits flaws in the MP4 module to crash worker processes or access sensitive memory content.
CVSS v3.0 Score: 6.1
Vulnerability 4 — [1.17.7 Information Disclosure]: Information disclosure due to improper handling of server responses
● Exploit Availability and Exploit Details: Yes, Exploits are available; an attacker sends crafted requests to extract sensitive information from HTTP responses
● Vulnerability ID: 134220
● Severity Level: Medium
● NIST Reference and CVSS Score / CVE: CVE-2019–20372 (CVSS v3.0 Score: 5.3)
● Patch Publication Date: December 24, 2019
● Vulnerability Publication Date: December 24, 2019
● NIST’s Description: According to NIST, “NGINX before 1.17.7, with certain error page configurations, allows HTTP request smuggling, as demonstrated by the ability of an attacker to read unauthorized web pages in environments where NGINX is being fronted by a load balancer.” NVD — cve-2019–20372
Patch Management
The vulnerability that was identified will be patched. The goal is to replace any outdated or manually installed versions of Nginx with the latest stable release available through the system’s package manager. To ensure consistency and automation, the patching process is executed using Ansible, a configuration management tool.
Install Ansible and Confirm Version
To install Ansible, enter the command
sudo apt update && sudo apt install ansible -y
After installation check the version of ansible installed
Create a YAML File for the Playbook
A YAML file is a simple text file with a .yml or .yaml extension
Step 1: Using nano or any text editor, create a YAML file by running the command line nano update_nginx.yml
This playbook uninstalled the outdated Nginx that was previously installed and install a new version of Nginx.
Run the playbook with this command line: ansible-playbook update_nginx.yml — ask-become-pass
The password of your becoming is your Kali password.
After running the playbook check and confirm the version of Nginx by running the command line: nginx -version.
I went back to Nessus to run a vulnerability scan on the new nginx, and there was no vulnerability found.
Recommended Mitigation
Recommendations and Best Practices for Strengthening Web Security
The following recommendations outline strategic and technical measures to prevent the recurrence of similar vulnerabilities and to enhance the overall security posture of web-facing systems.
1. Maintain Up-to-Date Software Versions
Ensure that Nginx and all dependent components are continuously updated to the latest stable releases. Regular updates reduce exposure to known exploits and improve compatibility with modern security protocols.
2. Harden Web Server Configurations
● Disable unused modules and restrict unnecessary HTTP methods.
● Enforce strong TLS configurations to secure data in transit.
● Limit request body sizes and connection timeouts to reduce the risk of denial-of-service (DoS) attacks.
3. Implement Secure DNS and Resolver Settings
Avoid insecure DNS configurations that may allow crafted DNS responses or memory overwrite vulnerabilities. Tune resolver timeouts and limits to prevent resource abuse and reduce the likelihood of DNS-based attacks.
4. Enable Application-Level Protections
Deploy a Web Application Firewall (WAF) to detect and block malicious traffic. Ensure input validation and error-handling mechanisms are properly implemented within hosted web applications to minimize injection and information disclosure risks.
5. Establish a Structured Patch Management Cycle
Formalize a patch management policy that includes scheduled reviews, testing, and deployment. Critical vulnerabilities should be addressed within defined remediation windows to reduce exposure time.
6. Implement Configuration Baselines
Adopt recognized security configuration benchmarks such as the Center for Internet Security (CIS) guidelines for Linux and web servers. This helps maintain a consistent and hardened baseline across environments.
7. Integrate Continuous Vulnerability Monitoring
Schedule authenticated vulnerability scans using Nessus or similar tools.
Integrate scan results into a Security Information and Event Management (SIEM) platform for real-time visibility and tracking of risk trends.
8. Maintain Exception and Remediation Tracking
Document all open vulnerabilities, associated risks, and remediation timelines.
Track temporary exceptions approved by management to ensure accountability and continuous follow-up.
9. Perform Routine Security Validation
Conduct periodic penetration tests and configuration audits to verify that implemented controls remain effective.
These exercises help identify new or re-emerging vulnerabilities promptly.
By combining these technical and procedural measures, organizations can transition from reactive patching to a continuous vulnerability management model that supports long-term resilience.
Best Practices for Ongoing Vulnerability Management
To maintain a resilient cybersecurity posture, vulnerability management must evolve from one-time remediation to a structured, continuous improvement process.
The following best practices will help institutionalize proactive detection, timely remediation, and sustainable system hardening across enterprise environments.
1. Adopt a Continuous Scanning Framework
Conduct regular authenticated scans, preferably monthly or after major configuration changes to ensure emerging threats and weaknesses are detected early.
2. Integrate Vulnerability Data with Security Operations
Feed scan results into a SIEM platform such as Microsoft Sentinel or Splunk.
This correlation helps connect vulnerability data with real-time events, improving incident response accuracy.
3. Leverage Threat Intelligence Feeds
Monitor trusted sources like the National Vulnerability Database (NVD), Common Vulnerabilities and Exposures (CVE) alerts, and Exploit Prediction Scoring System (EPSS) metrics.
This alignment ensures remediation efforts focus on vulnerabilities with real-world exploit potential.
4. Strengthen Reporting and Governance
Establish a monthly risk governance cycle supported by dashboards that track:
● Patch compliance rates
● Mean time to remediate (MTTR)
● Outstanding vulnerabilities
Use these reports to guide resource allocation and demonstrate compliance readiness.
5. Enhance Workforce Capability
Provide ongoing training for system administrators and developers on:
● Secure configuration practices
● Patch automation
● Vulnerability triage
This promotes a shared culture of security responsibility.
6. Align with Recognized Frameworks
Implement best practices based on:
● NIST Cybersecurity Framework (Identify, Protect, Detect, Respond, Recover)
● ISO/IEC 27002 Control A.12.6 — Technical Vulnerability Management
These frameworks ensure standardized, auditable, and repeatable processes across the organization.
Conclusion
By embedding these practices into daily operations, organizations can achieve measurable improvements in threat resilience, operational efficiency, and regulatory compliance.
This ensures that vulnerability management remains an adaptive, intelligence-driven process capable of addressing evolving risks effectively.
References
Crowdstrike. “What Is Vulnerability Assessment? | CrowdStrike.” Crowdstrike.com, 2023, www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/vulnerability-assessment/ Accessed 10 Oct. 2025.
Wang, B. (2023). What is Vulnerability Management? | CrowdStrike. [online] Crowdstrike.com. Available at: https://www.crowdstrike.com/en-us/cybersecurity-101/exposure-management/vulnerability-management/ [Accessed 10 Oct. 2025].
FIRST (2019) FIRST — Improving Security Together. [online] FIRST — Forum of Incident Response and Security Teams. Available at: https://www.first.org/ [Accessed 10 Oct. 2025].
CVE Details (2021) CVE security vulnerability database. Security vulnerabilities, exploits, references and more. [online] Cvedetails.com. Available at: https://www.cvedetails.com// [Accessed 10 Oct. 2025].
CWE (2022). CWE — Common Weakness Enumeration. [online] cwe.mitre.org. Available at: https://cwe.mitre.org/ [Accessed 10 Oct. 2025].
Offensive Security (2019). Offensive Security’s Exploit Database Archive. [online] Exploit-db.com. Available at: https://www.exploit-db.com/ [Accessed 10 Oct. 2025].
NVD (2025). NVD — Search and Statistics. [online] Nist.gov. Available at: https://nvd.nist.gov/vuln/search#/nvd/home?vulnRevisionStatusList=published&publishDateRangeStart=2021-07-01&publishDateRangeEnd=2021-07-31&resultType=records [Accessed 10 Oct. 2025].
whitesec cyber security (2025). Master Nessus in 2 Hours: Ethical Hacking & Pentesting with Nessus Scanner. [online] YouTube. Available at: https://www.youtube.com/watch?v=A9G-r550cPI [Accessed 13 Oct. 2025].
