CVE-2020-7350 Metasploit Framework Plugin Libnotify Command Injection
An attacker can execute arbitrary commands on the operator's terminal by providing a malicious hostname or service name via a file imported using db_import.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7350?
CVE-2020-7350 is a medium-severity command injection vulnerability in Rapid7 Metasploit Framework, published on 22 Apr 2020. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.
Weakness: CWE-78
Which versions are affected by CVE-2020-7350?
It affects 1 product.
Products include Rapid7 Metasploit.
How do I fix CVE-2020-7350?
No fix has been published for CVE-2020-7350 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-7350 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-7350 exists.
Public exploit code: 1 Metasploit module.
Other vulnerabilities in Rapid7 Metasploit Framework
- CVE-2020-7385 Metasploit Framework 'drb_remote_codeexec' code execution
- CVE-2020-7377 Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module
- CVE-2017-5235 Other in Metasploit Pro
- CVE-2019-5645 Rapid7 Metasploit HTTP Handler Denial of Service
- CVE-2019-5624 Rapid7 Metasploit Framework Zip Import Directory Traversal
Sources
Also known as GHSA-cvfg-6mg6-247m.