CyberRota Analysis
AI-GeneratedThe Metasploit Framework's JSON-RPC web service interface is vulnerable due to a logic flaw that allows unauthenticated local access when the environment variable for the API token is not set, leading to a fail-open condition during database health checks. This vulnerability could allow attackers to exploit the JSON-RPC request dispatcher without proper authentication, potentially compromising the integrity of the system. Organizations utilizing the Metasploit Framework should prioritize addressing this issue to mitigate risks associated with unauthorized access.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A logic vulnerability (fail-open condition) has been identified within the Metasploit Framework's JSON-RPC web service interface. When an exception occurs during the database health check (db.check) and the environment variable MSF_WS_JSON_RPC_API_TOKEN is not explicitly set, the application resets the internal state flag msf.auth_initialized to false. The ApiToken Warden authentication strategy misinterprets this false value as an indicator that authentication is not initialized or required, thereby granting unauthenticated local access to the JSON-RPC request dispatcher.