Metasploit
Monthly
Persistent code execution on a penetration tester's workstation is achievable through a relative path traversal (CWE-22) in the Metasploit Framework post module post/apple_ios/gather/ios_image_gather, affecting versions prior to 6.5.5. A hostile or tampered iOS device can return a crafted directory-listing entry (for example ../../msfconsole.rc) that the module interpolates without sanitization into the local destination path handed to client.fs.file.download_file(), overwriting ~/.msf4/msfconsole.rc, which every msfconsole invocation automatically executes at startup; because the written resource file can load a second written Ruby plugin, this converts into an interactive shell as the operator (frequently root) at the next console launch. Exploitation is not remote-unauthenticated against a default service: it requires operator interaction (UI:R) to run the specific gather module against an attacker-controlled Meterpreter session, no workstation authentication (PR:N) is needed, and the assessed attack complexity is High because the hostile device, the specific module, and the resulting file write must all align; no public exploit code was identified at time of analysis, and the flaw is fixed in the 6.5.5 release.
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Metasploit Framework before 6.5.7 allows an attacker-controlled HTTP server to redirect requests made through send_request_cgi! to arbitrary hosts reachable from the operator's network, including internal HTTP services. The CVSS 3.1 vector (4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) reflects that no privileges are required but the operator must interact with the malicious endpoint, and scope is changed because internal services can be reached. No public exploit was identified at time of analysis, and the issue is fixed in 6.5.7 via a new HttpRedirectPolicy that defaults to same_host.
Server-side request forgery in the Metasploit Framework FTP client libraries lets a rogue or compromised FTP server redirect an operator's data connection to an arbitrary host and port by supplying a crafted 227 PASV (or 229 EPSV) response. The flaw affects Metasploit Framework builds containing the pre-fix lib/metasploit/framework/ftp/client.rb, lib/msf/core/exploit/remote/ftp.rb, and lib/rex/proto/ftp/client.rb code, and is rated CVSS 4.7 (Medium) with UI:R because the operator must actively connect to the malicious server. No public exploit identified at time of analysis; exploitation yields blind outbound TCP connectivity only, consistent with C:L/I:N/A:N.
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
Persistent code execution on a penetration tester's workstation is achievable through a relative path traversal (CWE-22) in the Metasploit Framework post module post/apple_ios/gather/ios_image_gather, affecting versions prior to 6.5.5. A hostile or tampered iOS device can return a crafted directory-listing entry (for example ../../msfconsole.rc) that the module interpolates without sanitization into the local destination path handed to client.fs.file.download_file(), overwriting ~/.msf4/msfconsole.rc, which every msfconsole invocation automatically executes at startup; because the written resource file can load a second written Ruby plugin, this converts into an interactive shell as the operator (frequently root) at the next console launch. Exploitation is not remote-unauthenticated against a default service: it requires operator interaction (UI:R) to run the specific gather module against an attacker-controlled Meterpreter session, no workstation authentication (PR:N) is needed, and the assessed attack complexity is High because the hostile device, the specific module, and the resulting file write must all align; no public exploit code was identified at time of analysis, and the flaw is fixed in the 6.5.5 release.
Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Server-side request forgery in Metasploit Framework before 6.5.7 allows an attacker-controlled HTTP server to redirect requests made through send_request_cgi! to arbitrary hosts reachable from the operator's network, including internal HTTP services. The CVSS 3.1 vector (4.7, AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:N/A:N) reflects that no privileges are required but the operator must interact with the malicious endpoint, and scope is changed because internal services can be reached. No public exploit was identified at time of analysis, and the issue is fixed in 6.5.7 via a new HttpRedirectPolicy that defaults to same_host.
Server-side request forgery in the Metasploit Framework FTP client libraries lets a rogue or compromised FTP server redirect an operator's data connection to an arbitrary host and port by supplying a crafted 227 PASV (or 229 EPSV) response. The flaw affects Metasploit Framework builds containing the pre-fix lib/metasploit/framework/ftp/client.rb, lib/msf/core/exploit/remote/ftp.rb, and lib/rex/proto/ftp/client.rb code, and is rated CVSS 4.7 (Medium) with UI:R because the operator must actively connect to the malicious server. No public exploit identified at time of analysis; exploitation yields blind outbound TCP connectivity only, consistent with C:L/I:N/A:N.
Rapid7 Metasploit Pro versions 4.21.2 and lower suffer from a stored cross site scripting vulnerability, due to a lack of JavaScript request string sanitization. Rated medium severity (CVSS 4.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.
The Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the untar method which can be exploited to write. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
The Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method which can be exploited to write arbitrary files to. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) vulnerability in the 'notes' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target store an. Rated medium severity (CVSS 6.1), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Pro version 4.16.0-2019081901 and prior suffers from an instance of CWE-732, wherein the unique server.key is written to the file system during installation with world-readable. Rated low severity (CVSS 3.3), this vulnerability is low attack complexity. No vendor patch available.
Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Rated high severity (CVSS 7.3), this vulnerability is low attack complexity. Public exploit code available and no vendor patch available.
The web UI in Rapid7 Metasploit before 4.14.1-20170828 allows logout CSRF, aka R7-2017-22. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Public exploit code available and no vendor patch available.
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Rated low severity (CVSS 3.5), this vulnerability is remotely exploitable, low attack complexity. Public exploit code available and no vendor patch available.
Rapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer to load a malicious DLL located in the current. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi CommandDispatcher.cmd_download() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter extapi Clipboard.parse_dump() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.
All editions of Rapid7 Metasploit prior to version 4.13.0-2017020701 contain a directory traversal vulnerability in the Meterpreter stdapi Dir.download() function. Rated high severity (CVSS 7.1), this vulnerability is remotely exploitable, no authentication required. No vendor patch available.