CVE-2020-7384: 
Rapid7 Metasploit vulnerability analysis and mitigation

CVE-2020-7384 is a vulnerability in Rapid7's Metasploit msfvenom framework that was discovered in 2020. The vulnerability allows a malicious user to craft and publish an APK template file that would execute arbitrary commands on a victim's machine when processed by msfvenom (Rapid7 Blog, NVD).

The vulnerability exists in msfvenom's handling of APK template files. The issue occurs because msfvenom does not properly sanitize certain fields, such as the Owner field, that get passed into an Open3.popen3() call. This lack of sanitization allows for command injection through maliciously crafted APK templates (Rapid7 Blog).

When exploited, this vulnerability allows an attacker to execute arbitrary commands on the machine of any user who processes a malicious APK template file using msfvenom. This could lead to complete system compromise of the machine running msfvenom (NVD).

An exploit module was developed and added to the Metasploit Framework itself. The vulnerability can be triggered when a user processes a malicious APK template file using the msfvenom utility (Rapid7 Blog).

The vulnerability was fixed in Metasploit Framework version 6.0.12 and Metasploit Pro version 4.19.0. Users should upgrade to these versions or later to mitigate the vulnerability (Rapid7 Blog).