Attacker Value
Low
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
Required
Privileges Required
None
Attack Vector
Local
0

CVE-2020-7350

Disclosure Date: April 16, 2020
Add MITRE ATT&CK tactics and techniques that apply to this CVE.

Description

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer’s hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator’s terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue — notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation — the attacker would have to supply a file that is processed with the db_import command.

Add Assessment

1
Ratings
  • Attacker Value
    Low
  • Exploitability
    Medium
Technical Analysis

The Metasploit Framework’s libnotify plugin contains a vulnerability which can allow an attacker to execute an operating system command as the user running Metasploit. Exploiting the vulnerability requires the target user to have the libnotify plugin loaded, and then to load a malicious file using msfconsole’s db_import command.

The root of the problem is the way in which arguments are passed to Ruby’s system function to execute the operating system command. A maliciously crafted service name can add additional arguments and commands to this call, leading to code execution. The vulnerable code path will only be hit the first time the service is reported, i.e. repeatedly loading the malicious file with db_import will not result in the command being executed multiple times unless the user deletes the service between attempts.

This vulnerability was patched in https://github.com/rapid7/metasploit-framework/pull/13266.

CVSS V3 Severity and Metrics
Base Score:
7.8 High
Impact Score:
5.9
Exploitability Score:
1.8
Vector:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack Vector (AV):
Local
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
Required
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • Rapid7

Products

  • Metasploit Framework

Additional Info

Technical Analysis