Regular expression denial of service in Rapid7 Metasploit
High severity
Unreviewed
Published
May 5, 2021
to the GitHub Advisory Database
•
Updated Feb 1, 2023
Description
Published by the National Vulnerability Database
Sep 1, 2020
Published to the GitHub Advisory Database
May 5, 2021
Last updated
Feb 1, 2023
By sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expression. When evaluated, this malicious handler can either prevent new HTTP handler sessions from being established, or cause a resource exhaustion on the Metasploit server.
References