NFS Shares World Readable

Tenable plugin 42256 fires when an NFS server exports one or more shares to * — meaning any host that can reach port 2049 can mount the share without authentication. No exploit is required: a single mount -t nfs target:/share /mnt command gives the attacker full read access to whatever lives on the export. If no_root_squash is also set (a separate but commonly co-occurring misconfiguration), the attacker additionally gets root-equivalent write access and can plant SUID binaries for privilege escalation. This affects all NFS server implementations — Linux nfs-kernel-server, FreeBSD nfsd, Solaris, NetApp ONTAP — wherever /etc/exports or its equivalent contains an entry without host restrictions.

Tenable's own CVSS v3 score is 7.5 HIGH (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N), while the legacy CVSS v2 score is 5.0 MEDIUM — which is likely the source of your '(?)'. The v3 rating is the correct baseline. The vector correctly notes zero-auth, high-confidentiality impact. However, the Network attack vector slightly overstates internet exposure — in practice, port 2049 is almost never internet-facing. The real danger is *internal*: post-initial-access, every compromised workstation or rogue contractor laptop on the same VLAN gets instant access. For enterprises using NFS-backed backup repositories, VMware datastores, or home directories, the data behind those exports is often the crown jewels.

1. Restrict /etc/exports to specific host IPs or subnets immediately — Replace * entries with specific client CIDR ranges: /data 10.1.2.0/24(ro,root_squash). Run exportfs -ra to reload. This is the definitive fix and is a configuration change — no package update, no reboot, no downtime. Deploy within 30 days per the noisgate mitigation SLA for HIGH findings. Most teams can execute this in hours once the authorized client list is confirmed.
2. Firewall NFS ports to authorized clients at the host level — Configure iptables/nftables/firewalld on every NFS server to allow ports 111 and 2049 only from known NFS client IPs. This provides defense-in-depth: even if /etc/exports is misconfigured, unauthorized hosts cannot reach the service. Deploy within 30 days alongside the exports fix.
3. Verify root_squash is set on every export — Run grep -r no_root_squash /etc/exports /etc/exports.d/ on every NFS server. Any match must be removed immediately — root_squash is the default, but legacy configs frequently override it. Eliminating no_root_squash blocks the SUID privilege escalation path entirely. Fix alongside the ACL remediation.
4. Migrate to NFSv4 with Kerberos authentication — Configure sec=krb5 or sec=krb5p on NFSv4 exports to require Kerberos tickets for mount and file access. This eliminates UID spoofing and unauthorized mounts entirely. This is a more involved change requiring Kerberos infrastructure — plan within the 180-day noisgate remediation SLA for HIGH findings.
5. Segment NFS traffic into dedicated storage VLANs — Place NFS servers and authorized clients on isolated storage VLANs with inter-VLAN ACLs preventing workstation/user segments from reaching port 2049. This limits the blast radius of any compromised endpoint. Plan as part of network segmentation initiatives within 180 days.

Run this script from any Linux host with network access to the target NFS server. Usage: bash check_nfs_world_readable.sh 10.1.2.50. Requires showmount (install via apt install nfs-common or yum install nfs-utils). No root privileges needed for the check itself — it only queries export metadata, it does not mount anything.

#!/usr/bin/env bash
# check_nfs_world_readable.sh — Detect world-readable NFS exports
# noisgate verification script for Tenable plugin 42256
# Usage: bash check_nfs_world_readable.sh <target_ip>
# Exit codes: 1=VULNERABLE, 0=PATCHED, 2=UNKNOWN

set -uo pipefail

TARGET="${1:-}"
if [[ -z "$TARGET" ]]; then
  echo "Usage: $0 <target_ip_or_hostname>"
  echo "Example: $0 10.1.2.50"
  exit 2
fi

# Dependency check
if ! command -v showmount &>/dev/null; then
  echo "UNKNOWN — 'showmount' not found."
  echo "Install: apt install nfs-common (Debian/Ubuntu) or yum install nfs-utils (RHEL/CentOS)"
  exit 2
fi

# Query NFS exports from the target
EXPORTS=$(showmount -e "$TARGET" 2>&1)
RC=$?
if [[ $RC -ne 0 ]]; then
  if echo "$EXPORTS" | grep -qi 'no exports\|no such\|not registered'; then
    echo "PATCHED — NFS server at $TARGET has no exports or NFS is not running."
    exit 0
  fi
  echo "UNKNOWN — Could not query NFS exports on $TARGET (port 111/2049 unreachable?)."
  echo "Error: $EXPORTS"
  exit 2
fi

# Parse for world-readable exports (client list is * or (everyone) or empty)
# showmount -e output format: /path  client1,client2  or  /path  *  or  /path  (everyone)
WORLD_READABLE=$(echo "$EXPORTS" | tail -n +2 | awk '{if ($NF == "*" || $NF == "(everyone)" || NF == 1) print $0}')

if [[ -n "$WORLD_READABLE" ]]; then
  echo "VULNERABLE — World-readable NFS exports found on $TARGET:"
  echo "---"
  echo "$WORLD_READABLE"
  echo "---"
  echo "These exports have no host-based ACL restrictions."
  echo "Fix: Add client restrictions in /etc/exports, then run 'exportfs -ra'."
  exit 1
else
  echo "PATCHED — All NFS exports on $TARGET have host-based ACL restrictions."
  echo "Exports found:"
  echo "$EXPORTS" | tail -n +2
  exit 0
fi

1. Tenable Plugin 42256 — NFS Shares World Readable
2. NetSPI — Linux Hacking Case Studies Part 2: NFS
3. HvS-Consulting — NFS Security: Identifying and Exploiting Misconfigurations
4. Huntress — NFS Security: What It Is, How It's Exploited & How to Defend It
5. MITRE ATT&CK — T1039: Data from Network Shared Drive
6. Juggernaut Security — NFS no_root_squash Privilege Escalation
7. Red Hat — Security Scan States NFS Shares World Readable
8. Route Zero — NFS Cheat Sheet for Penetration Testers (2025)