Metasploit Framework Plugin Libnotify Command Injection

Description

Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.

Scores

EPSS (exploitation in 30 days)

5.0% · top 7.7% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Medium 6.1.

Weakness

• CWE-78 OS Command Injection (opens in a new tab)All about CWE-78 and its CVEs

Affected products

• Rapid7 · Metasploit Framework

  • affected 5.0.85 – < 5.0.85

What to do

Solution: This issue is resolved in Metasploit Pro version 5.0.85

Exploitation: An exploit is available at the CONRIM link, along with the fix.

References (1)

• https://github.com/rapid7/metasploit-framework/issues/13026 (opens in a new tab)x_refsource_CONFIRMx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisories (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2020-7350](https://trackcve.app/badge/CVE-2020-7350.svg)](https://trackcve.app/cve/CVE-2020-7350)

Record last updated 17 Sept 2024, 00:51 UTC.