Metasploit Framework web service lets unauthenticated users create an administrator account
If Metasploit's web service has no admin account yet, anyone can make one.
Summary
The msf-ws REST API of Metasploit Framework accepts user creation without authentication while the users table is empty, so an unauthenticated attacker can create an administrator account. Versions before 6.5.9 are affected.
Affected when
- users table empty (no administrator account created yet)
What to do
Update to version 6.5.9 or later.
Products and platforms
CVE IDs
Sources
- CVE record: cve.org (opens in a new tab)
Times
First published
First seen