CVE-2026-7373
HighSummary
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. An attacker can exploit an OpenSSL configuration file to trick the high-privilege service into executing arbitrary commands.
Risk Assessment
This vulnerability allows a low-privileged user, such as 'vagrant', to bypass security controls and achieve full host compromise. This can lead to serious security breaches within the organization.
Recommendation
It is recommended to restrict access to configuration files and monitor user accounts to prevent the creation of low-privileged accounts that could be exploited for privilege escalation.
Other vulnerabilities in Rapid7 Metasploit Pro
Original NVD description (English source)
Rapid7 Metasploit Pro is vulnerable to a local privilege escalation attack that allows a user to gain SYSTEM level control of a Windows host. When started the metasploitPostgreSQL service would start the postgres.exe child process which would in turn load an OpenSSL configuration file from a static location. This static location would be writable by a pre-existing "vagrant" user, if they already existed on the system. Metasploit does not create local accounts, an Administrator would need to create it. By planting a crafted openssl.cnf file an attacker can trick the high-privilege service into executing arbitrary commands. This effectively permits the unprivileged vagrant user to bypass security controls and achieve a full host compromise under the agent's SYSTEM level access.