CVE-2020-7385: 
Ruby vulnerability analysis and mitigation

CVE-2020-7385 is a security vulnerability in the Metasploit Framework's DRuby remote code execution module (exploit/linux/misc/drb_remote_codeexec). The vulnerability was discovered and reported by Jeff Dileo of NCC Group through Metasploit's vulnerability disclosure process. When a user runs this module, they inadvertently expose their own Metasploit instance to the same deserialization vulnerability they are attempting to exploit (Rapid7 PR).

The vulnerability is classified as CWE-502 (Deserialization of Untrusted Data). The core issue lies in the DRuby module starting a service that itself becomes vulnerable to exploitation. When targeting a malicious server, that server could exploit the running instance of Metasploit to gain code execution within the context of the user running Metasploit (Rapid7 PR Remove).

An attacker could exploit this vulnerability to gain code execution within the context of the user running Metasploit. This creates a scenario where the tool intended for offensive security testing becomes a vector for compromise of the security tester themselves (Rapid7 PR Remove).

Initially, a patch was implemented in October 2020 to prevent the DRuby service from starting automatically. However, due to the inability to properly secure the module against malicious server responses, the ultimate mitigation was to completely remove the DRuby remote code execution module from the Metasploit Framework (Rapid7 PR Remove).