CVE-2023-0599: 
Rapid7 Metasploit vulnerability analysis and mitigation

Rapid7 Metasploit Pro versions 4.21.2 and lower contain a stored cross-site scripting (XSS) vulnerability due to insufficient JavaScript request string sanitization. The vulnerability was discovered and disclosed in January 2023, affecting the individual host services page of Metasploit Pro installations (Rapid7 Release Notes, NVD).

The vulnerability stems from inadequate sanitization of JavaScript request strings, which allows for stored cross-site scripting attacks. The severity of this vulnerability has been assessed with a CVSS v3.1 base score of 4.8 (Medium) by NIST and 6.1 (Medium) by Rapid7. The CVSS vector string is CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:L/I:L/A:N, indicating network accessibility, low attack complexity, high privileges required, and user interaction needed (NVD).

When exploited, this vulnerability allows an authenticated attacker to execute arbitrary HTML and script code in the target browser against another Metasploit Pro user through a specially crafted request. The impact is particularly significant as most Metasploit Pro users typically have privileges equivalent to local administrator access (NVD).

The vulnerability requires an authenticated attacker to craft a specific request that can execute arbitrary HTML and script code in the target browser. The attack requires high privileges and user interaction to be successful. The vulnerability has been reported by security researcher Michael Caruso through coordinated disclosure (Rapid7 Release Notes).

The vulnerability has been addressed in Metasploit Pro version 4.22.0-2023013001. Users are advised to upgrade to this version or later to mitigate the risk. The fix was implemented as part of the January 30, 2023 release (Rapid7 Release Notes).