CVE-2020-7385
📋 TL;DR
CVE-2020-7385 is a deserialization vulnerability in Metasploit Framework's drb_remote_codeexec module that allows remote code execution on the attacker's own system when running the module against a malicious endpoint. This affects Metasploit users who run the vulnerable module, potentially compromising their workstation due to Metasploit's elevated privileges. The attack requires social engineering where a user is tricked into targeting a malicious server.
💻 Affected Systems
- Metasploit Framework
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of the Metasploit workstation with attacker gaining the same elevated privileges as Metasploit, potentially leading to lateral movement in the network.
Likely Case
Limited compromise of the Metasploit workstation if the user runs the module against a malicious endpoint, though this requires specific social engineering.
If Mitigated
No impact if the vulnerable module is not used or if Metasploit is patched to the fixed version.
🎯 Exploit Status
The exploit is built into Metasploit itself (drb_remote_codeexec module), making weaponization trivial for attackers who can set up malicious endpoints. However, exploitation requires user interaction to run the module.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Metasploit Framework versions including the October 2020 updates (specifically after pull requests #14300 and #14335)
Vendor Advisory: https://help.rapid7.com/metasploit/release-notes/archive/2020/10/
Restart Required: No
Instructions:
1. Update Metasploit Framework to the latest version using 'msfupdate' or package manager. 2. Verify the update includes fixes from pull requests #14300 and #14335. 3. No restart needed, but ensure Metasploit is not actively running the vulnerable module during update.
🔧 Temporary Workarounds
Disable or remove drb_remote_codeexec module
linuxPrevent use of the vulnerable module by disabling or removing it from Metasploit.
mv /usr/share/metasploit-framework/modules/exploits/linux/misc/drb_remote_codeexec.rb /usr/share/metasploit-framework/modules/exploits/linux/misc/drb_remote_codeexec.rb.disabled
Run Metasploit with reduced privileges
allLimit potential damage by running Metasploit without elevated privileges where possible.
sudo -u lowprivilegeuser msfconsole
🧯 If You Can't Patch
- Avoid using the drb_remote_codeexec module entirely. Do not run it against untrusted or unknown endpoints.
- Implement strict network controls to prevent Metasploit workstations from communicating with unauthorized external servers.
🔍 How to Verify
Check if Vulnerable:
Check if the drb_remote_codeexec module exists and if Metasploit version is before October 2020 updates. Run 'msfconsole' and then 'use exploit/linux/misc/drb_remote_codeexec' - if it loads, you may be vulnerable.Check Version:
msfconsole -vVerify Fix Applied:
Update Metasploit and verify the module is patched or removed. Check version with 'msfconsole -v' and confirm it's post-October 2020. Attempt to use the module and verify it's been mitigated.📡 Detection & Monitoring
Log Indicators:
- Log entries showing execution of drb_remote_codeexec module in Metasploit logs
- Unexpected processes spawned with Metasploit privileges
Network Indicators:
- Outbound connections from Metasploit workstation to unknown external IPs on port 8787 (default DRb port) or other ports
SIEM Query:
source="metasploit.log" AND "drb_remote_codeexec" OR process_name="ruby" AND parent_process="msfconsole" AND cmdline="*DRb*"🔗 References
- https://github.com/rapid7/metasploit-framework/pull/14300
- https://github.com/rapid7/metasploit-framework/pull/14335
- https://help.rapid7.com/metasploit/release-notes/archive/2020/10/
- https://github.com/rapid7/metasploit-framework/pull/14300
- https://github.com/rapid7/metasploit-framework/pull/14335
- https://help.rapid7.com/metasploit/release-notes/archive/2020/10/
