CVE-2020-7354 Rapid7 Metasploit Pro Stored XSS in 'host' field
An attacker can inject malicious scripts via a scanned host's name, leading to code execution or account takeover when an operator views the asset in Metasploit Pro.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2020-7354?
CVE-2020-7354 is a medium-severity cross-site scripting vulnerability in Rapid7 Metasploit Pro, published on 25 Jun 2020. An attacker needs administrator access to exploit it, and only if a user opens a file or follows a link.
Official description
Cross-site Scripting (XSS) vulnerability in the 'host' field of a discovered scan asset in Rapid7 Metasploit Pro allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console, which will trigger when the operator views the record of that scanned host in the Metasploit Pro interface. This issue affects Rapid7 Metasploit Pro version 4.17.1-20200427 and prior versions, and is fixed in Metasploit Pro version 4.17.1-20200514. See also CVE-2020-7355, which describes a similar issue, but involving the generated 'notes' field of a discovered scan asset.
Weakness: CWE-79
Which versions are affected by CVE-2020-7354?
It affects 1 product.
Products include Rapid7 Metasploit.
How do I fix CVE-2020-7354?
No fix has been published for CVE-2020-7354 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2020-7354 being exploited?
There is no known exploitation of CVE-2020-7354 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Metasploit Pro
- CVE-2020-7385 Metasploit Framework 'drb_remote_codeexec' code execution
- CVE-2020-7377 Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module
- CVE-2017-5235 Other in Metasploit Pro
- CVE-2019-5645 Rapid7 Metasploit HTTP Handler Denial of Service
- CVE-2019-5624 Rapid7 Metasploit Framework Zip Import Directory Traversal
Sources
Also known as GHSA-833m-hwf9-64gc.