CVE-2020-7385: rapid7 metasploit Deserialization of Untrusted Data

Vulnerability summary

CVE-2020-7385 is a high (CVSS 8.8) Deserialization of Untrusted Data vulnerability in rapid7 metasploit. EPSS estimates a 1.75% chance of exploitation in the next 30 days, higher than 77.6% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 23-04-2021
   PublishedVulnerability first disclosed.
2. 17-09-2024
   Last modifiedVulnerability information updated.

Description

By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.

• CWE-502Deserialization of Untrusted DataThe product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.