CVE-2020-7385
Metasploit Framework 'drb_remote_codeexec' code execution
- Published
- Updated
- Reserved
- Assigned by
- rapid7
Description
By launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that is exploited by that module, due to the reliance on the vulnerable Distributed Ruby class functions. Since Metasploit Framework typically runs with elevated privileges, this can lead to a system compromise on the Metasploit workstation. Note that an attacker would have to lie in wait and entice the Metasploit user to run the affected module against a malicious endpoint in a "hack-back" type of attack. Metasploit is only vulnerable when the drb_remote_codeexec module is running. In most cases, this cannot happen automatically.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| rapid7CNA (assigner) | 3.1 | High8.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N |
| NVDNVD · Modified | 3.1 | High8.8 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
- EPSS (exploitation in 30 days)
- 1.8% · top 22% of all CVEs (6 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 8.1.
Weakness
Affected products
- affected 6.0.15 – ≤ 6.0.15
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- RubyGemsmetasploit-frameworkGHSA-xgww-h98f-24qf (opens in a new tab)
What to do
Solution: Do not run the drb_remote_codeexec module. After commit 659137da94fa2fe56ce5c44d611db3692bf7d2e5, the Metasploit Framework no longer ships with the affected module.
References (3)
- https://github.com/rapid7/metasploit-framework/pull/14300 (opens in a new tab)x_refsource_MISCx_transferred
- https://help.rapid7.com/metasploit/release-notes/archive/2020/10/ (opens in a new tab)x_refsource_MISCx_transferred
- https://github.com/rapid7/metasploit-framework/pull/14335 (opens in a new tab)x_refsource_CONFIRMx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-xgww-h98f-24qf (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2020-7385)Record last updated .