{"answers":{"affected":"2 open source packages ship an affected version, including metasploit-framework. It affects 1 product.","exploited":"There is no known exploitation of CVE-2020-7385 in the wild and no public exploit code.","fix":"Upgrade metasploit-framework to 4.19.0 or later.","what":"CVE-2020-7385 is a high-severity unsafe deserialization vulnerability in Rapid7 Metasploit Framework, published on 23 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link."},"fix_prompt":"Check this codebase for CVE-2020-7385 and fix it if it is affected.\n\nWhat it is: CVE-2020-7385 is a high-severity unsafe deserialization vulnerability in Rapid7 Metasploit Framework, published on 23 Apr 2021. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.\nExploitation: There is no known exploitation of CVE-2020-7385 in the wild and no public exploit code.\n\nAffected packages and fixed versions:\n- metasploit-framework (RubyGems): affected all versions; fixed in 4.19.0\n- metasploit-framework (RubyGems): affected all versions; fixed in 4.19.0\n\nTask:\n1. Search the dependency manifests and lockfiles (for example package.json, package-lock.json, requirements.txt, poetry.lock, uv.lock, pom.xml, build.gradle, go.mod, Cargo.lock, Gemfile.lock) and any Dockerfiles for the affected packages, including transitive dependencies.\n2. If an affected version is in use, upgrade it to the fixed version for its release line with the project's package manager, so the lockfile is regenerated. Prefer the smallest upgrade that fixes it.\n3. If there is no fix, or the upgrade would break the build, do not guess: explain the risk and the safest workaround instead.\n4. Run the tests and summarise what changed and why.\n5. If nothing in the project is affected, say so and change nothing.\n\nReference: https://insights.sbomify.com/CVE-2020-7385/ (Markdown: https://insights.sbomify.com/CVE-2020-7385/index.md)","id":"CVE-2020-7385","markdown":"https://insights.sbomify.com/CVE-2020-7385/index.md","name":"CVE-2020-7385","record":{"aliases":["GHSA-xgww-h98f-24qf"],"analysis":{"component_type":"developer_tool","fix_type":"patch","impacts":["code_execution","privilege_escalation"],"network_reachable":"yes","non_default_config":true,"product_category":"Metasploit Framework","requires_auth":"none","summary":"A malicious endpoint can trigger remote code execution on the Metasploit workstation when a user runs the drb_remote_codeexec module, leading to system compromise.","user_interaction":"required","vuln_class":"deserialization"},"analysis_generated_by":"qwen3.8-flash-next","assigner":"rapid7","cpe":[{"product":"metasploit","vendor":"rapid7"}],"cvss":{"score":8.1,"severity":"high","source":"cna","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N","version":"3.1"},"cwes":[{"id":"CWE-502","name":"Deserialization of Untrusted Data"}],"description":"By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a \"hack-back\" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.","ecosystems":["RubyGems"],"exploits":{"exploitdb":0,"first_seen":null,"github_poc":0,"max_poc_stars":null,"metasploit":0,"nuclei":0,"refs":[],"tier":"none_known"},"has_fix":true,"headline":"Metasploit Framework 'drb_remote_codeexec' code execution","id":"CVE-2020-7385","indexable":true,"kev":null,"kind":"cve","links":{"ecosystem":"RubyGems","product":null,"products":[],"type":"deserialization","year":"2020"},"n_packages":2,"n_references":3,"next":{"headline":"Sage X3 AdxAdmin Exposure of Sensitive Information to an Unauthorized Actor","id":"CVE-2020-7387"},"packages":[{"ecosystem":"RubyGems","fixed":["4.19.0"],"introduced":["0"],"last_affected":[],"package":"metasploit-framework","purl":null,"source":"GHSA-xgww-h98f-24qf"},{"ecosystem":"RubyGems","fixed":["4.19.0"],"introduced":["0"],"last_affected":[],"package":"metasploit-framework","purl":"pkg:gem/metasploit-framework","source":"GHSA-xgww-h98f-24qf"}],"prev":{"headline":"Client-Side Command Injection in Rapid7 Metasploit","id":"CVE-2020-7384"},"products":["Metasploit Framework"],"published":"2021-04-23","related":[{"cvss_score":8.1,"headline":"Rapid7 Metasploit Framework Relative Path Traversal in telpho10_credential_dump module","id":"CVE-2020-7377","kev_date_added":null,"published":"2020-08-24"},{"cvss_score":7.8,"headline":"Other in Metasploit Pro","id":"CVE-2017-5235","kev_date_added":null,"published":"2017-03-02"},{"cvss_score":7.5,"headline":"Rapid7 Metasploit HTTP Handler Denial of Service","id":"CVE-2019-5645","kev_date_added":null,"published":"2020-09-01"},{"cvss_score":7.4,"headline":"Rapid7 Metasploit Framework Zip Import Directory Traversal","id":"CVE-2019-5624","kev_date_added":null,"published":"2019-04-30"},{"cvss_score":7.1,"headline":"Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module","id":"CVE-2020-7376","kev_date_added":null,"published":"2020-08-24"},{"cvss_score":7.1,"headline":"Path traversal in Metasploit","id":"CVE-2017-5228","kev_date_added":null,"published":"2017-03-02"}],"sources":[{"class":"attribution","licence":"CVE Terms of Use (MITRE)","name":"CVE List","prefix":"CVE"},{"class":"attribution","licence":"CC BY 4.0","name":"GitHub Advisory Database","prefix":"GHSA"},{"class":"attribution","licence":"US public information, NVD API terms","name":"NVD"},{"class":"attribution","licence":"CWE Terms of Use","name":"CWE (MITRE)"},{"class":"attribution","licence":"FIRST CVSS licence","name":"CVSS (FIRST)"}],"ssvc":{"automatable":null,"exploitation":null,"technical_impact":null},"state":"PUBLISHED","updated":"2024-09-17","vendors":["Rapid7"]},"summary":"A malicious endpoint can trigger remote code execution on the Metasploit workstation when a user runs the drb_remote_codeexec module, leading to system compromise.","url":"https://insights.sbomify.com/CVE-2020-7385/"}