Summary
A relative path traversal vulnerability in Metasploit's iOS image-gathering post module allows device-controlled filenames to escape the intended local loot directory. If an operator runs the module against a hostile or tampered device, an attacker may overwrite files in the operator's environment, potentially leading to persistent code execution when Metasploit starts.
A relative path traversal vulnerability in Metasploit's iOS image-gathering post module allows device-controlled filenames to escape the intended local loot directory. If an operator runs the module against a hostile or tampered device, an attacker may overwrite files in the operator's environment, potentially leading to persistent code execution when Metasploit starts.
Affected context
The issue occurs in deployments where the Metasploit iOS image-gathering module downloads files listed by a Meterpreter session to a local destination. It becomes risky when directory-entry names originate from an untrusted or compromised device and are incorporated into local paths without removing path separators or otherwise constraining the resulting destination.
The issue occurs in deployments where the Metasploit iOS image-gathering module downloads files listed by a Meterpreter session to a local destination. It becomes risky when directory-entry names originate from an untrusted or compromised device and are incorporated into local paths without removing path separators or otherwise constraining the resulting destination.
Exploit preconditions
- Attack surface: The local file-download path used by the iOS image-gathering
post module
- Required access: The attacker must control or influence the device-side
directory listing and persuade an operator to run the module
- Trigger point: Processing a listed filename while constructing the local
download destination
- Why exploitation is possible: The destination path is passed to a file
writing operation without sufficient normalization or confinement, allowing
relative path components to escape the intended directory
- Attack surface: The local file-download path used by the iOS image-gathering
post module
- Required access: The attacker must control or influence the device-side
directory listing and persuade an operator to run the module
- Trigger point: Processing a listed filename while constructing the local
download destination
- Why exploitation is possible: The destination path is passed to a file
writing operation without sufficient normalization or confinement, allowing
relative path components to escape the intended directory
Why this happens
The module treats filenames received from a remote directory listing as safe local path components. It interpolates those values into a destination path without applying a basename operation, separator scrub, canonicalization, or containment check. This insecure trust-boundary decision maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because attacker controlled path syntax can redirect writes outside the designated directory.
The module treats filenames received from a remote directory listing as safe local path components. It interpolates those values into a destination path without applying a basename operation, separator scrub, canonicalization, or containment check. This insecure trust-boundary decision maps to CWE-22, Improper Limitation of a Pathname to a Restricted Directory, because attacker controlled path syntax can redirect writes outside the designated directory.
Potential impact
- An attacker may overwrite files accessible to the Metasploit operator.
- The attack could alter startup or resource configuration used by Metasploit.
- Modified configuration may cause code or plugins to load during a later console launch.
- The attacker may obtain interactive code execution with the operator's privileges.
- A compromised workstation could expose credentials, engagement data, or other sensitive files.
- An attacker may overwrite files accessible to the Metasploit operator.
- The attack could alter startup or resource configuration used by Metasploit.
- Modified configuration may cause code or plugins to load during a later console launch.
- The attacker may obtain interactive code execution with the operator's privileges.
- A compromised workstation could expose credentials, engagement data, or other sensitive files.
General mitigation guidance
Mitigation generally focuses on treating all remote filenames as untrusted data and enforcing a destination-directory boundary. Secure patterns include reducing each entry to a trusted basename when recursive paths are not required, rejecting traversal markers and path separators, resolving the candidate path and verifying that it remains beneath the intended directory, and using APIs that separate filenames from directory paths. Downloads should use dedicated, least-privileged directories with restrictive permissions, and security-sensitive startup files should not be writable by routine tooling. Operator workflows can further reduce trust in device-provided metadata and isolate collection activity from privileged workstations.
Mitigation generally focuses on treating all remote filenames as untrusted data and enforcing a destination-directory boundary. Secure patterns include reducing each entry to a trusted basename when recursive paths are not required, rejecting traversal markers and path separators, resolving the candidate path and verifying that it remains beneath the intended directory, and using APIs that separate filenames from directory paths. Downloads should use dedicated, least-privileged directories with restrictive permissions, and security-sensitive startup files should not be writable by routine tooling. Operator workflows can further reduce trust in device-provided metadata and isolate collection activity from privileged workstations.
How teams detect issues like this
Detection approaches include static analysis for concatenation or interpolation of external filenames into filesystem paths, review rules that require basename extraction or canonical containment checks, and tests using traversal markers and platform-specific separators. Code review should examine every local file-writing sink reached from remote directory listings and verify that validation occurs before path construction. Policy enforcement can flag writes outside approved working directories and monitor unexpected changes to startup, resource, or plugin files. Automated code review and dependency security tools may help identify these patterns.
Detection approaches include static analysis for concatenation or interpolation of external filenames into filesystem paths, review rules that require basename extraction or canonical containment checks, and tests using traversal markers and platform-specific separators. Code review should examine every local file-writing sink reached from remote directory listings and verify that validation occurs before path construction. Policy enforcement can flag writes outside approved working directories and monitor unexpected changes to startup, resource, or plugin files. Automated code review and dependency security tools may help identify these patterns.
