CVE-2026-7373— Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading

Metasploit Pro on Windows: Local Privilege Escalation via OpenSSL Configuration File Loading

Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.

N/A

从非可信控制范围包含功能例程

Rapid7 Metasploit Pro 访问控制错误漏洞

Rapid7 Metasploit Pro是美国Rapid7公司的一套渗透测试软件。 Rapid7 Metasploit Pro存在访问控制错误漏洞，该漏洞源于启动时metasploitPostgreSQL服务尝试从标准用户可写的非存在目录加载OpenSSL配置文件，可能导致低权限用户通过放置特制的openssl.cnf文件欺骗高权限服务执行任意命令，从而绕过安全控制并在代理的SYSTEM级别访问下实现完全主机破解。

N/A

N/A