Summary
The Metasploit Framework Web Service REST API fails to authenticate requests to the credential update and deletion handlers. An unauthenticated client that can reach the service may read, modify, or permanently delete stored passwords, hashes, and private keys.
The Metasploit Framework Web Service REST API fails to authenticate requests to the credential update and deletion handlers. An unauthenticated client that can reach the service may read, modify, or permanently delete stored passwords, hashes, and private keys.
Affected context
The vulnerability occurs in the Metasploit Framework Web Service credential API when the service is reachable by an attacker and requests are handled by the affected update or delete routes. The handlers invoke credential database operations without performing the authentication check applied by other credential endpoints, allowing access to shared engagement records when network exposure permits it.
The vulnerability occurs in the Metasploit Framework Web Service credential API when the service is reachable by an attacker and requests are handled by the affected update or delete routes. The handlers invoke credential database operations without performing the authentication check applied by other credential endpoints, allowing access to shared engagement records when network exposure permits it.
Exploit preconditions
- Attack surface: Metasploit Framework Web Service REST API, specifically the credential update and deletion routes
- Required access: Network reachability to the web service; no valid credentials are required
- Trigger point: A request to the affected credential update or delete handler
- Why exploitation is possible: The handlers omit
warden.authenticate!, and the underlying credential database methods do not enforce authorization independently
- Attack surface: Metasploit Framework Web Service REST API, specifically the credential update and deletion routes
- Required access: Network reachability to the web service; no valid credentials are required
- Trigger point: A request to the affected credential update or delete handler
- Why exploitation is possible: The handlers omit
warden.authenticate!, and the underlying credential database methods do not enforce authorization independently
Why this happens
The vulnerability results from inconsistent authentication enforcement across REST API handlers. The affected routes dispatch directly to credential-management functions without first verifying the caller's identity, while the lower-level database layer provides no compensating authorization check. This maps to CWE-306: Missing Authentication for Critical Function, because sensitive credential operations are reachable without an authentication requirement.
The vulnerability results from inconsistent authentication enforcement across REST API handlers. The affected routes dispatch directly to credential-management functions without first verifying the caller's identity, while the lower-level database layer provides no compensating authorization check. This maps to CWE-306: Missing Authentication for Critical Function, because sensitive credential operations are reachable without an authentication requirement.
Potential impact
- An unauthenticated attacker may read stored credential records through the exposed credential API
- Attackers could disclose passwords, password hashes, and private keys
- Credential records could be modified or poisoned
- Stored credentials could be permanently deleted
- Compromised credentials may enable unauthorized access to monitored environments or shared team engagements
- An unauthenticated attacker may read stored credential records through the exposed credential API
- Attackers could disclose passwords, password hashes, and private keys
- Credential records could be modified or poisoned
- Stored credentials could be permanently deleted
- Compromised credentials may enable unauthorized access to monitored environments or shared team engagements
General mitigation guidance
Mitigation should focus on enforcing authentication and authorization consistently at every sensitive API boundary.
Common defensive patterns include:
- Require authentication before dispatching any credential read or mutation operation
- Apply authorization checks at both the route and service or database layers
- Deny access by default when authentication context is missing or invalid
- Restrict network exposure of the web service to trusted administrative interfaces
- Run the service with least-privilege access and minimize the scope of stored credentials
- Monitor and protect credential records as high-sensitivity data
Mitigation should focus on enforcing authentication and authorization consistently at every sensitive API boundary.
Common defensive patterns include:
- Require authentication before dispatching any credential read or mutation operation
- Apply authorization checks at both the route and service or database layers
- Deny access by default when authentication context is missing or invalid
- Restrict network exposure of the web service to trusted administrative interfaces
- Run the service with least-privilege access and minimize the scope of stored credentials
- Monitor and protect credential records as high-sensitivity data
How teams detect issues like this
Organizations can identify similar issues through:
- Static analysis that checks sensitive route handlers for missing authentication middleware or guard calls
- Code review of every read, update, and delete endpoint affecting secrets or credentials
- Tests that submit unauthenticated requests to all security-sensitive API routes and verify denial
- Policy enforcement requiring centralized authentication and authorization middleware for protected resources
- Logging and alerting on unauthenticated requests, credential enumeration, bulk updates, or deletion activity
Automated security review tools may help detect route-level inconsistencies, but endpoint-focused tests remain important for confirming enforcement behavior.
Organizations can identify similar issues through:
- Static analysis that checks sensitive route handlers for missing authentication middleware or guard calls
- Code review of every read, update, and delete endpoint affecting secrets or credentials
- Tests that submit unauthenticated requests to all security-sensitive API routes and verify denial
- Policy enforcement requiring centralized authentication and authorization middleware for protected resources
- Logging and alerting on unauthenticated requests, credential enumeration, bulk updates, or deletion activity
Automated security review tools may help detect route-level inconsistencies, but endpoint-focused tests remain important for confirming enforcement behavior.
Sources
| Source | Link |
|---|---|
| github. | github.com/ |
| github. | github.com/ |
