Rapid7 Metasploit Pro Local Privilege Escalation Vulnerability

A local privilege escalation vulnerability has been identified in Rapid7 Metasploit Pro. This issue allows users to gain SYSTEM-level control on a Windows host. The vulnerability arises when the metasploitPostgreSQL service, initiated at startup, attempts to load an OpenSSL configuration file from a non-existent directory that is writable by standard users. By placing a crafted openssl.cnf file in this directory, an attacker can manipulate the high-privilege service into executing arbitrary commands. This exploitation enables an unprivileged user to bypass security measures and achieve full host compromise with the agent's SYSTEM-level access.

Impact

Exploitation of this vulnerability leads to unauthorized users gaining SYSTEM-level privileges on the affected Windows host, allowing for a complete compromise of the system.