HTTP Redirect to Arbitrary Host in Metasploit Framework

Executive Summary

CVE-2026-109682 is a vulnerability in Metasploit Framework versions before 6.5.7 where HTTP requests made through send_request_cgi! could follow redirects to different hosts without restrictions. This allows a malicious HTTP server to trick Metasploit into making requests to arbitrary HTTP services on the operator's network, including internal services not accessible to the attacker.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your Metasploit Framework version is below 6.5.7. Run 'msfconsole --version' to verify the installed version. If it is outdated, update to version 6.5.7 or later to address the redirect handling issue.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability could allow an attacker to access internal network services by exploiting Metasploit's redirect behavior. It may lead to unauthorized data exposure, credential forwarding, or interaction with sensitive internal systems if the attacker controls a malicious server.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could indirectly impact compliance with standards like GDPR or HIPAA by potentially exposing internal services or sensitive data through unauthorized HTTP redirects. If an attacker exploits this flaw to access internal systems, it may lead to data breaches or unauthorized data exposure, violating confidentiality requirements under these regulations.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the Metasploit Framework to version 6.5.7 or later. This version includes fixes for unsafe HTTP redirects and credential forwarding. Review modules using send_request_cgi for compatibility after the update.

Useful 0 Not Useful 0