CVE-2020-7384

Client-Side Command Injection in Rapid7 Metasploit

Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.

Affected

Rapid7 · Metasploit

CVSS v3.1 NVD

7.8 HIGHCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v3.1 RAPID7

7.0 HIGHCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

CVSS v2.0 NVD

9.3 HIGHAV:N/AC:M/Au:N/C:C/I:C/A:C

EPSS

30.46% chance of exploitation in the next 30 days, 98th percentile

Published

2020-10-29

Updated

2024-08-04

Proof-of-concept exploits (6)

• http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Temp…
• http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection…
• 0xCarsonS/CVE-2020-73840★ · 2023-02-21
• CarsonShaffer/CVE-2020-73840★ · 2023-02-21
• mrinalprakash45/Hack-The-Box_Script-Kiddie0★ · 2021-05-20
• nikhil1232/CVE-2020-738411★ · 2021-02-07

Metasploit modules (1)

• rapid7/metasploit-framework/blob/master/modules/exploits/unix/fileformat/metasploit_msfve…

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/49491

Security advisories

• rapid7/metasploit-framework/pull/14288

References

• CVE Record
• NVD entry

Related

• CVE-2018-11471