Published: 30/04/2019 Updated: 01/02/2023

CVSS v2 Base Score: 6.5 | Impact Score: 6.4 | Exploitability Score: 8

CVSS v3 Base Score: 7.3 | Impact Score: 5.9 | Exploitability Score: 1.3

VMScore: 578

Vector: AV:N/AC:L/Au:S/C:P/I:P/A:P

Rapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the Zip import function of Metasploit. Exploiting this vulnerability can allow an malicious user to execute arbitrary code in Metasploit at the privilege level of the user running Metasploit. This issue affects: Rapid7 Metasploit Framework version 4.14.0 and prior versions.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rapid7 metasploit

A proof of concept for Metasploit's CVE-2019-5624 vulnerability (Rubyzip insecure ZIP handling RCE)

CVE-2019-5624 A proof of concept for Metasploit's CVE-2019-5624 vulnerability (Rubyzip insecure ZIP handling RCE) Intro In February 2019 I found a new vulnerability in the Rubyzip library It allows an attacker to exploit insecure ZIP handling (Zip Slip) resulting in remote command execution This vulnerability was leveraged to targets all Metasploit versions < 50

CWE-22 https://help.rapid7.com/metasploit/release-notes/archive/2019/04/#20190416 https://github.com/rapid7/metasploit-framework/pull/11716 https://blog.doyensec.com/2019/04/24/rubyzip-bug.html https://nvd.nist.gov https://github.com/VoidSec/CVE-2019-5624 https://blog.doyensec.com/2019/04/24/rubyzip-bug.html

Get Started

Vulmon Search is a vulnerability search engine. It gives comprehensive vulnerability information through a very simple user interface.

Home Recent Vulnerabilities Research Posts Trends Blog About Contact

Vulmon Search Vulmon Research Vulmon Alerts Vulmap

Twitter Reddit Linkedin Facebook

CVE-2019-5624

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect