CVE-2020-7385 : What You Need to Know
Learn about CVE-2020-7385, a high-severity vulnerability in Metasploit Framework that could allow remote code execution. Find out the impact, affected systems, and mitigation steps.
A vulnerability in the Metasploit Framework could allow an attacker to execute code remotely, potentially compromising the system.
Understanding CVE-2020-7385
This CVE involves a specific module in the Metasploit Framework that, when exploited, can lead to system compromise.
What is CVE-2020-7385?
By launching the drb_remote_codeexec exploit, a user of the Metasploit Framework may inadvertently expose the system to a deserialization issue, potentially leading to a system compromise.
The Impact of CVE-2020-7385
- CVSS Base Score: 8.1 (High)
- Attack Vector: Network
- Confidentiality Impact: High
- Integrity Impact: High
- Privileges Required: None
- User Interaction: Required
- This vulnerability can result in a system compromise on the Metasploit workstation.
Technical Details of CVE-2020-7385
This section provides more technical insights into the vulnerability.
Vulnerability Description
The vulnerability arises from the reliance on vulnerable Distributed Ruby class functions when running the drb_remote_codeexec module in Metasploit Framework.
Affected Systems and Versions
- Affected Product: Metasploit Framework
- Vendor: Rapid7
- Affected Version: 6.0.15 (custom version)
Exploitation Mechanism
- The vulnerability can be exploited by enticing a Metasploit user to run the affected module against a malicious endpoint.
- Metasploit is vulnerable only when the drb_remote_codeexec module is running.
Mitigation and Prevention
Protecting systems from CVE-2020-7385 requires immediate actions and long-term security practices.
Immediate Steps to Take
- Avoid running the drb_remote_codeexec module.
- Ensure the Metasploit Framework is updated to a version beyond commit 659137da94fa2fe56ce5c44d611db3692bf7d2e5.
Long-Term Security Practices
- Regularly update and patch the Metasploit Framework.
- Educate users on the risks associated with running untrusted modules.
Patching and Updates
- After commit 659137da94fa2fe56ce5c44d611db3692bf7d2e5, the affected module is no longer included in the Metasploit Framework.