CVE-2020-7354: 
Rapid7 Metasploit vulnerability analysis and mitigation

A Cross-site Scripting (XSS) vulnerability was identified in Rapid7 Metasploit Pro, tracked as CVE-2020-7354. The vulnerability affects the 'host' field of discovered scan assets in Metasploit Pro version 4.17.1-20200427 and prior versions. The issue was discovered and reported in January 2020, with the CVE being assigned on January 21, 2020 (CVE MITRE).

The vulnerability allows an attacker with a specially-crafted network service of a scan target to store an XSS sequence in the Metasploit Pro console. The malicious payload triggers when an operator views the record of the scanned host in the Metasploit Pro interface. This vulnerability is related to CVE-2020-7355, which describes a similar issue but affects the 'notes' field instead of the 'host' field (CVE MITRE).

When exploited, this vulnerability could allow attackers to execute malicious scripts in the context of the Metasploit Pro console, potentially compromising the security of the scanning system and exposing sensitive information when operators view affected host records (CVE MITRE).

The vulnerability requires an attacker to have control over a network service that is being scanned by Metasploit Pro. The attacker must be able to inject malicious XSS payloads through the host field, which would then be stored and executed when viewed in the Metasploit Pro interface (CVE MITRE).

The vulnerability has been fixed in Metasploit Pro version 4.17.1-20200514. Users are advised to upgrade to this version or later to mitigate the risk. The fix was released as part of Rapid7's security updates in May 2020 (Rapid7 Release Notes).