Quick take - The latest update of the Metasploit Framework, released on December 13, 2024, highlights several critical remote code execution vulnerabilities affecting platforms such as Moodle, Primefaces, WordPress, and CyberPanel, emphasizing the need for organizations to implement timely software updates to mitigate potential security risks.

Fast Facts

The Metasploit Framework’s December 13, 2024 update highlights critical remote code execution (RCE) vulnerabilities in platforms like Moodle, Primefaces, WordPress, and CyberPanel.
A command injection flaw in Moodle (CVE-2024-43425) allows remote code execution, necessitating immediate updates to the e-Learning platform.
Primefaces has multiple exploit modules addressing a padding oracle attack vulnerability, urging updates to versions 5.2.21, 5.3.8, or 6.0 or later.
WordPress’s Really Simple SSL plugin has a session hijacking vulnerability (CVE-2024-10924), requiring updates beyond version 9.1.1.1 to protect site integrity.
CyberPanel vulnerabilities could lead to Denial of Service (DoS) attacks, with updates recommended for CVE-2024-51378, CVE-2024-51567, and CVE-2024-51568 to mitigate risks.

Metasploit Framework Update Unveils Critical Vulnerabilities Across Key Platforms

On December 13, 2024, the Metasploit Framework released its latest update, spotlighting several critical remote code execution (RCE) vulnerabilities affecting widely-used platforms such as Moodle, Primefaces, WordPress, and CyberPanel. This release underscores the persistent challenges organizations face in defending their systems against evolving security threats.

Moodle’s Command Injection Flaw

One of the most significant vulnerabilities identified is a command injection flaw in Moodle, tracked as CVE-2024-43425. This vulnerability allows attackers to execute arbitrary code remotely, posing a severe risk to the e-Learning platform’s integrity. Immediate updates are crucial to mitigate potential exploitation and safeguard educational institutions relying on Moodle for online learning.

Primefaces Padding Oracle Attack

The update also introduces multiple exploit modules for Primefaces to address a padding oracle attack vulnerability linked to weak cryptography. This issue could enable unauthorized access to sensitive data or systems if left unpatched. Organizations using Primefaces are advised to update to versions 5.2.21, 5.3.8, or 6.0 or later to enhance their security posture.

WordPress Session Hijacking Threat

WordPress users are not spared, with vulnerabilities identified in the Really Simple SSL plugin. A session hijacking vulnerability allows attackers to retrieve an administrator’s session cookie, potentially compromising site integrity. Users should update the plugin beyond version 9.1.1.1 to counter this threat, referenced as CVE-2024-10924.

CyberPanel Denial of Service Risks

CyberPanel users face vulnerabilities that could lead to Denial of Service (DoS) attacks, threatening service continuity for organizations dependent on CyberPanel for operations. The vulnerabilities cataloged as CVE-2024-51378, CVE-2024-51567, and CVE-2024-51568 necessitate prompt updates to prevent potential disruptions.

Perfect Survey Plugin SQL Injection

Additionally, the advisory highlights an unauthenticated SQL Injection vulnerability in the Perfect Survey plugin, which enables attackers to dump user credentials from databases. This significantly increases the risk of data breaches and underscores the need for immediate remediation efforts.

Broader Security Implications

The Metasploit Framework’s latest update serves as a critical reminder for organizations to prioritize timely software updates and patch management. The implications of these vulnerabilities can lead to severe security incidents, including unauthorized access, data breaches, and service disruptions.

As cyber threats continue to evolve, proactive measures are essential in protecting sensitive information and maintaining operational integrity. Organizations must remain vigilant and responsive to emerging threats by regularly updating their systems and employing robust security practices.

References