CVE-2020-7384

CVE-2020-7384 describes a command injection vulnerability in Rapid7's Metasploit msfvenom framework, specifically impacting its handling of APK files. This flaw allows an attacker to craft a malicious APK that, when processed by msfvenom, executes arbitrary commands on the victim's machine. With a CVSS score of 7.8 (HIGH), the vulnerability is easily exploitable with low attack complexity and no privileges required, leading to high impacts on confidentiality, integrity, and availability. While not listed in CISA's KEV catalog, public exploit modules exist for Metasploit and ExploitDB, indicating readily available exploitation tools, though there is no evidence of active exploitation or significant community discussion.