CVE-2020-7385 Metasploit Framework 'drb_remote_codeexec' code execution
A malicious endpoint can trigger remote code execution on the Metasploit workstation when a user runs the drb_remote_codeexec module, leading to system compromise.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- Available
What is CVE-2020-7385?
CVE-2020-7385 is a high-severity unsafe deserialization vulnerability in Rapid7 Metasploit Framework, published on 23 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.
Weakness: CWE-502
Which versions are affected by CVE-2020-7385?
2 open source packages ship an affected version, including metasploit-framework. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
metasploit-framework RubyGems | All versions | 4.19.0 |
metasploit-framework RubyGems | All versions | 4.19.0 |
Products include Rapid7 Metasploit.
How do I fix CVE-2020-7385?
Upgrade metasploit-framework to 4.19.0 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2020-7385 being exploited?
There is no known exploitation of CVE-2020-7385 in the wild and no public exploit code.
Other vulnerabilities in Rapid7 Metasploit Framework
- CVE-2020-7377 Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module
- CVE-2017-5235 Other in Metasploit Pro
- CVE-2019-5645 Rapid7 Metasploit HTTP Handler Denial of Service
- CVE-2019-5624 Rapid7 Metasploit Framework Zip Import Directory Traversal
- CVE-2020-7376 Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module
Sources
Also known as GHSA-xgww-h98f-24qf.