HTTP client & server mixins don't play nice in the same module (datastore overloads)

Open
#3,753 11 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
35/100
Issue type
Bug
Clarity
Mostly clear
Activity status
Stale
Tech stack
ruby

Research direction

Start with the oracle_reports_rce module and compare its HTTP setup with hagent_untrusted_hsdata, both named in the issue. Investigate how the client and server mixins register and consume SSL, then determine whether manually starting the web server or separating the option resolves the certificate failure. Done means oracle_reports_rce can use an SSL client without causing the web server to reject the remote connection.

Written by the indexing model from the issue text.

Description

feature module

TL;DR: Setting SSL to true prevents the module oracle_reports_rce from working as it is currently written.

This module includes both the HTTP client and HTTP server mixins, both of which register an option called SSL. This fails when the client has to use SSL, because it then enables SSL for the web server, and the remote code will drop the connection due to an invalid certificate.

Solving this would be taking a leaf from hagent_untrusted_hsdata and spin up the web server manually. Alternatively, we can try to find a way to make these two mixins cohabitate, but that would require, at the least, changing the name of the SSL option to something like SSLServer.

Dominant language
Ruby
Stars
39k
Forks
15k
Avg merge
5d 6h
Merged PRs (30d)
32

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from rapid7/metasploit-framework

All issues in rapid7/metasploit-framework

Similar issues

More Ruby issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.