What’s Vulnerable › Vulnerabilities

CVE-2020-7384: Client-Side Command Injection in Rapid7 Metasploit

• Severity: high (CVSS 7.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 30.5% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2020-10-29 · updated 2026-06-17
• Weakness: CWE-77

Description

Rapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arbitrary commands on a victim's machine.

Affected products

• Rapid7 Metasploit Framework: before 4.19.0 — fixed in 4.19.0

How to fix

Upgrade to a fixed version: Rapid7 Metasploit Framework 4.19.0. Check the vendor advisory for mitigations.

References

• http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.html
• http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.html
• https://github.com/rapid7/metasploit-framework/pull/14288
• http://packetstormsecurity.com/files/160004/Rapid7-Metasploit-Framework-msfvenom-APK-Template-Command-Injection.html
• http://packetstormsecurity.com/files/161200/Metasploit-Framework-6.0.11-Command-Injection.html
• https://github.com/rapid7/metasploit-framework/pull/14288

Get alerted when CVE-2020-7384 or the next vulnerability affects your stack