CVE-2020-7385

CVE-2020-7385 describes a critical deserialization vulnerability in Rapid7 Metasploit Framework, specifically when the drb_remote_codeexec module is actively running. An attacker could exploit this by enticing a Metasploit user to target a malicious endpoint, leading to remote code execution and potential system compromise on the Metasploit workstation, often running with elevated privileges. With a CVSS score of 8.8 (HIGH), this vulnerability has a network attack vector, low attack complexity, and high impact on confidentiality, integrity, and availability, though user interaction is required. There is currently no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.