CVE-2020-7376: Rapid7 Metasploit Framework Relative Path Traversal in enum_osx module
The Metasploit Framework module "post/osx/gather/enumosx module" is affected by a relative path traversal vulnerability in the getkeychains method which can be exploited to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.
Affected Software
Remediation
Patch Available
Information
Event History
Frequently Asked Questions
What is CVE-2020-7376?
CVE-2020-7376 is a vulnerability in the Metasploit Framework module "post/osx/gather/enum_osx module", which allows relative path traversal and can be exploited to write arbitrary files to arbitrary locations on the host filesystem.
How does the vulnerability in CVE-2020-7376 affect Metasploit Framework?
The vulnerability affects the get_keychains method in the Metasploit Framework module, allowing an attacker to write arbitrary files to arbitrary locations on the host filesystem when the module is run on a malicious host.
What is the severity of CVE-2020-7376?
The severity of CVE-2020-7376 is critical, with a severity value of 9.8.
Which version of Rapid7 Metasploit is affected by CVE-2020-7376?
Rapid7 Metasploit versions 4.11.7 to 6.0.3 are affected by CVE-2020-7376.
How can I fix or mitigate CVE-2020-7376?
Update Rapid7 Metasploit to a version that is not affected by CVE-2020-7376, and follow any additional instructions or patches provided by Rapid7.