New Vulnerabilities and Updates in Metasploit Framework

The Metasploit framework has recently introduced new exploit modules and significant improvements, highlighting critical vulnerabilities in widely used software. Here is a detailed analysis of the latest news.

New Exploit Modules

Apache ActiveMQ RCE via Jolokia

A new exploit module, CVE-2026-34197, targets the remote code execution (RCE) vulnerability in Apache ActiveMQ. This exploitation abuses the Jolokia JMX-over-HTTP API exposed at the address /api/jolokia/, calling the MBean operation addNetworkConnector() with a URI brokerConfig=xbean:http://... controlled by the attacker. ActiveMQ retrieves the attacker-controlled URL and instantiates it as a Spring XML application context, allowing remote code execution via a bean java.lang.ProcessBuilder. Authentication is required to exploit this vulnerability.

Gogs Git Rebase Argument Injection RCE

An exploit module has been added for the remote code execution (RCE) vulnerability in the Gogs pull request merge process, versions <= 0.14.2 and <= 0.15.0+dev. This exploitation leverages argument injection in the pull request merge workflow.

Enumeration of Windows Kernel Pointers

A new post module for Windows enumerates kernel object pointers exposed via NtQuerySystemInformation on x64 systems. This module collects observable handle metadata and provides an analysis of the pointer distribution, object types, and ALPC usage, saving the results in a CSV file for later review. Additionally, it introduces a reusable library for Windows kernel handle enumeration.

Improvements and Features

  • Kerberos Hash Cracking: Support for Kerberos hash cracking has been added, including timeroasting, krb5tgs*, and krb5asrep.
  • Payloads Manager: New plugin to maintain a local repository of custom payloads and load them into the data directory.
  • Post Module Execution: Post modules now run by default against the last opened active session, unless explicitly specified.
  • HTTP Scanning: HTTP login scanners now report the hierarchy of the detected service.
  • Addition of CVE References: Missing CVE references have been added to seven existing modules.
  • Stability and Logging Improvements: Improvements to the ipmicipherzero, ipmidumphashes, and ipmiversion modules.

Bug Fixes

  • Fixed a bug in modules that invoke other modules preventing datastore option validation.
  • Resolved an issue with CIDR range filters in the addresses parameter of the db.hosts RPC endpoint.
  • Fixed Python SSL shell payloads that failed with AttributeError.
  • Improved the GitLab version scanner to handle additional exceptions and add more version fingerprints.
  • Fixed a crash in the scanner/snmp/snmp_enum module when the system date was read as Null.
  • Added a guard clause when running uname -r in the WSL startup folder persistence.
  • Fixed some references to obsolete msfvenom options.

Documentation and Updates

The latest Metasploit documentation is available on docs.metasploit.com. To update to the latest Metasploit framework, you can use msfupdate. Further details on changes since the last blog post are available on GitHub.

For Git users, you can clone the Metasploit Framework repository (master branch) for the latest version. To install without using Git, you can use the open-source Nightly Installers or the commercial edition Metasploit Pro.

Impact and Practical Applications of the Updates

The latest updates to Metasploit introduce new capabilities that could significantly influence cybersecurity practices. The exploit for Apache ActiveMQ via Jolokia, for example, poses a serious risk to infrastructures using this messaging system, as it allows remote code execution through a social engineering activity. This type of vulnerability is particularly insidious because it exploits a legitimate API for malicious purposes.

The module for collecting Windows kernel pointers, developed by CharlesQuinnDev, offers security analysts a valuable tool for identifying potential privilege escalation paths. Combining this technique with well-chosen write primitives can facilitate the acquisition of elevated privileges on compromised systems, making it a fundamental resource for penetration testing assessments.

Security Considerations and Best Practices

In light of these new vulnerabilities, it is crucial that system administrators take immediate preventive measures. For Apache ActiveMQ, it is advisable to restrict access to the Jolokia API and apply security patches as soon as they become available. Additionally, implementing role-based access controls and adopting robust authentication policies can mitigate the risk of exploitation.

For Gogs users, it is essential to update to the latest versions of the software to avoid exposure to vulnerabilities related to the pull request merge process. Adopting secure development practices, such as code review and isolation of sensitive functionalities, can further reduce the risk of attacks.

Emerging Trends and the Future of Cybersecurity

The latest updates to Metasploit reflect a growing trend towards exploring vulnerabilities related to open-source software components. This phenomenon underscores the importance of careful dependency management and continuous monitoring of known vulnerabilities. The cybersecurity community is increasingly recognizing the importance of collaborating with software vendors to identify and resolve these vulnerabilities quickly.

Furthermore, the integration of advanced information gathering tools, such as the module for collecting kernel pointers, indicates an evolution towards more sophisticated approaches to security assessment. These tools enable security experts to identify and exploit vulnerabilities with greater precision, contributing to the continuous improvement of defensive practices.

Additional Resources and Support

For more information on how to protect infrastructures from these vulnerabilities, you can consult the resources provided by Rapid7 and the Metasploit community. The official documentation and discussion forums offer a wide range of technical and strategic information for advanced users.

Additionally, active participation in the open-source community can provide valuable learning and collaboration opportunities. Contributing to cybersecurity projects and sharing your findings can help build a safer ecosystem for all users.

Editorial Note and Disclaimer

The guides and content published on GoYou are the result of independent research and analysis activities, for informational, educational, and in-depth purposes.

GoYou does not constitute a journalistic publication or an editorial product pursuant to Law No. 62/2001 and does not provide real-time information.

The GoYou project does not provide professional, technical, legal, or financial advice and disclaims any liability for the misuse of the information published.

In the Crypto sector, every investment involves risks: readers are invited to always inform themselves independently before making any decision.