Metasploit Framework 'drb_remote_codeexec' code execution

Vulnerability

The drb_remote_codeexec module in Metasploit Framework relies on Distributed Ruby (DRb) class functions that are vulnerable to deserialization attacks [1]. When a user launches this module, Metasploit starts a DRb service that listens for connections. This service can be exploited by a malicious endpoint if the user targets it. The vulnerability is present in all versions of Metasploit Framework that include this module prior to the fix. The module is not automatically executed; the user must explicitly run it against a target [1].

Exploitation

An attacker must lie in wait and entice the Metasploit user to run the drb_remote_codeexec module against a malicious endpoint in a "hack-back" type of attack [1]. The attacker's endpoint then sends crafted serialized data to the DRb service running on the Metasploit workstation, triggering the deserialization vulnerability [2]. No authentication or prior access to the Metasploit system is required; the attacker only needs to be reachable over the network from the Metasploit workstation.

Impact

Successful exploitation allows the attacker to execute arbitrary code within the context of the Metasploit Framework process [1]. Since Metasploit typically runs with elevated privileges (e.g., root or administrator), this can lead to full compromise of the Metasploit workstation, including data exfiltration, installation of backdoors, or further lateral movement [1].

Mitigation

The vulnerability was initially addressed in Metasploit Framework via pull request #14300 (commit 49145bf), which removed the DRb service after module execution to prevent exploitation by arbitrary third parties [2]. However, this fix did not cover the scenario where the targeted server itself is malicious. Consequently, pull request #14335 removed the drb_remote_codeexec module entirely from the framework [4]. Users should update to the latest version of Metasploit Framework to ensure the module is no longer present. No workaround exists other than avoiding use of the module [4].