CVE-2026-7373

Executive Summary

CVE-2026-7373 is a local privilege escalation vulnerability in Rapid7 Metasploit Pro on Windows. The flaw resides in the metasploitPostgreSQL service, which upon startup attempts to load an OpenSSL configuration file (openssl.cnf) from a non-existent directory that is writable by standard users. An unprivileged attacker can plant a malicious openssl.cnf file in that directory, causing the high-privilege service to execute arbitrary commands with SYSTEM-level access. This allows a full host compromise from a low-privileged user context.

Note: This vulnerability is specific to the Windows platform and the Metasploit Pro product. It is not related to any WordPress plugin or component.

Supply Chain & Package Security

This vulnerability is not in an open-source package manager (NPM, PyPI, Go, Ruby) but in a commercial product’s service configuration. The attack vector relies on a missing directory and writable filesystem location, which is a classic insecure default configuration issue.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
• Base Score: 7.8 (High)
• Attack Vector: Local (AV:L) – requires local access to the Windows host.
• Attack Complexity: Low (AC:L) – no special conditions beyond writable directory.
• Privileges Required: Low (PR:L) – attacker needs standard user access.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – the vulnerable component and the impacted component are the same.
• Confidentiality, Integrity, Availability: All High (C:H/I:H/A:H) – full SYSTEM compromise.

Threat Level: High. Although local access is required, the low complexity and high impact make it attractive for post-exploitation or insider threats.

Deep Dive & Mechanics

The vulnerability is a classic unquoted service path / insecure file placement issue combined with a missing directory:

1. Service Startup: The metasploitPostgreSQL service starts and launches postgres.exe.
2. OpenSSL Configuration Loading: The service attempts to load an OpenSSL configuration file (openssl.cnf) from a specific directory.
3. Missing Directory: The directory does not exist by default, but it is located in a path that is writable by standard users (e.g., C:\ProgramData\Metasploit\ or similar).
4. Attacker Action: An unprivileged user creates the missing directory and places a crafted openssl.cnf file.
5. Exploitation: When the service starts (or restarts), it loads the attacker’s openssl.cnf, which contains directives to execute arbitrary commands (e.g., using the openssl_conf or system directives).
6. Privilege Escalation: The commands run with SYSTEM privileges, granting the attacker full control.

Root Cause: The service does not verify the existence or integrity of the configuration directory before loading the file, and the directory is placed in a location writable by low-privileged users.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):
The service likely uses a hardcoded or relative path for the OpenSSL config file without checking if the directory exists or if the file is from a trusted source.

// Vulnerable: loads config from a writable path
const char* config_path = "C:\\ProgramData\\Metasploit\\openssl.cnf";
OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, config_path);

Patched Code (Hypothetical):
The fix would involve either:

• Using a secure, non-writable directory (e.g., C:\Program Files\Metasploit\conf\).
• Checking directory permissions before loading.
• Using a hardcoded, trusted config file.

// Patched: use a secure path with proper permissions
const char* config_path = "C:\\Program Files\\Metasploit\\conf\\openssl.cnf";
if (access(config_path, F_OK) == 0) {
    OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, config_path);
}

Note: No official patch has been released as of this report.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Windows host with Metasploit Pro installed.
• Low-privileged user access (e.g., via phishing or initial foothold).
• The service metasploitPostgreSQL must be running or restartable.

Exploitation Steps:

1. Identify the target directory:
   Use icacls or accesschk to find writable directories where the service looks for openssl.cnf. Common candidates:
   C:\ProgramData\Metasploit\
C:\Users\Public\Metasploit\

2. Create the directory and malicious config:

   mkdir C:\ProgramData\Metasploit
   

3. Craft openssl.cnf:
   The file can use OpenSSL’s openssl_conf section to execute commands. Example:

   [openssl_init]
   engines = engine_section
   
   [engine_section]
   system = system_section
   
   [system_section]
   engine_id = system
   dynamic_path = C:\Windows\System32\cmd.exe
   init = 1
   

   Note: This is a simplified example; actual exploitation may require more complex directives.

4. Trigger service restart:

   sc stop metasploitPostgreSQL
   sc start metasploitPostgreSQL
   

   Or wait for a system reboot.

5. Gain SYSTEM shell:
   The malicious config executes a command (e.g., adds a user or spawns a reverse shell).

Alternative Method:
If the service does not restart automatically, an attacker could wait for a scheduled task or user action that triggers the service.

Blue Team (Detection & Defense)

Detection Steps:

1. Monitor for file creation in suspicious directories:
   Alert on creation of openssl.cnf in C:\ProgramData\Metasploit\ or similar paths.

2. Audit service startup events:
   Windows Event ID 7036 (service state change) for metasploitPostgreSQL.

3. Check for unusual child processes:
   postgres.exe spawning cmd.exe or powershell.exe is anomalous.

4. Review OpenSSL configuration loading:
   Use Sysmon or ETW to detect when openssl.cnf is loaded from non-standard paths.

Mitigation (Temporary):

• Create the directory manually and set restrictive permissions (e.g., only SYSTEM and Administrators).
• Use AppLocker or WDAC to block execution of untrusted binaries.
• Disable the service if not needed.

Indicators of Compromise (IOCs)

Detection Engineering

YARA Rule

rule CVE_2026_7373_openssl_cnf {
    meta:
        description = "Detects malicious openssl.cnf used in CVE-2026-7373"
        author = "Valters IT"
        date = "2025-04-14"
        reference = "CVE-2026-7373"
    strings:
        $s1 = "[openssl_init]" nocase
        $s2 = "engine_section" nocase
        $s3 = "system_section" nocase
        $s4 = "dynamic_path" nocase
    condition:
        all of ($s*) and filesize < 10KB
}

Sigma Rule

title: CVE-2026-7373 - Metasploit Pro Local Privilege Escalation
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects creation of openssl.cnf in Metasploit writable directories
author: Valters IT
date: 2025-04-14
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\openssl.cnf'
        TargetFilename|contains: '\Metasploit\'
    condition: selection
falsepositives:
    - Legitimate Metasploit configuration changes (rare)
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2026-7373 - Metasploit Pro LPE - Reverse Shell"; flow:to_server,established; content:"|4d 5a|"; offset:0; depth:2; content:"|00 00 00 00|"; distance:0; within:4; classtype:attempted-admin; sid:1000001; rev:1;)

Note: This is a generic reverse shell detection; adjust based on actual payload.

Remediation & Mitigation

Immediate Actions:

1. Restrict directory permissions:
   Create the missing directory (e.g., C:\ProgramData\Metasploit\) and set permissions to SYSTEM and Administrators only.

   New-Item -ItemType Directory -Path "C:\ProgramData\Metasploit" -Force
   icacls "C:\ProgramData\Metasploit" /inheritance:r /grant "SYSTEM:(OI)(CI)F" /grant "Administrators:(OI)(CI)F"
   

2. Disable the service if not required:

   sc config metasploitPostgreSQL start= disabled
   sc stop metasploitPostgreSQL
   

3. Monitor for exploitation attempts using the provided detection rules.

Long-Term Fix:

• Rapid7 should release a patch that changes the configuration directory to a secure, non-writable location (e.g., within Program Files).
• Implement integrity checks for the OpenSSL config file.

Workaround:
If the service must run, create a dummy openssl.cnf file with no malicious content in the writable directory to preempt the attack.

Valters IT