Metasploit Framework
Monthly
Unauthenticated local access to Metasploit Framework's JSON-RPC dispatcher is possible via a fail-open logic flaw (CWE-305) in the ApiToken Warden authentication strategy. When the MSF_WS_JSON_RPC_API_TOKEN environment variable is unset and the db.check health-check method raises an exception, the internal msf.auth_initialized flag is reset to false - which the Warden misinterprets as authentication being uninitialised rather than failed, bypassing token enforcement entirely. A vendor-released upstream fix is available via GitHub PR #21768; no public exploit code and no CISA KEV listing have been identified at time of analysis.
Unauthenticated local access to Metasploit Framework's JSON-RPC dispatcher is possible via a fail-open logic flaw (CWE-305) in the ApiToken Warden authentication strategy. When the MSF_WS_JSON_RPC_API_TOKEN environment variable is unset and the db.check health-check method raises an exception, the internal msf.auth_initialized flag is reset to false - which the Warden misinterprets as authentication being uninitialised rather than failed, bypassing token enforcement entirely. A vendor-released upstream fix is available via GitHub PR #21768; no public exploit code and no CISA KEV listing have been identified at time of analysis.