HTTP client & server mixins don't play nice in the same module (datastore overloads)
Nobody has claimed this yet.
Assessment
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Newbie friendliness
- 35/100
- Issue type
- Bug
- Clarity
- Mostly clear
- Activity status
- Stale
- Tech stack
- ruby
- Domain
- networking, security
Research direction
Start with the oracle_reports_rce module and compare its HTTP setup with hagent_untrusted_hsdata, both named in the issue. Investigate how the client and server mixins register and consume SSL, then determine whether manually starting the web server or separating the option resolves the certificate failure. Done means oracle_reports_rce can use an SSL client without causing the web server to reject the remote connection.
Written by the indexing model from the issue text.
Description
TL;DR: Setting SSL to true prevents the module oracle_reports_rce from working as it is currently written.
This module includes both the HTTP client and HTTP server mixins, both of which register an option called SSL. This fails when the client has to use SSL, because it then enables SSL for the web server, and the remote code will drop the connection due to an invalid certificate.
Solving this would be taking a leaf from hagent_untrusted_hsdata and spin up the web server manually. Alternatively, we can try to find a way to make these two mixins cohabitate, but that would require, at the least, changing the name of the SSL option to something like SSLServer.
- Dominant language
- Ruby
- Stars
- 39k
- Forks
- 15k
- Avg merge
- 5d 6h
- Merged PRs (30d)
- 32
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from rapid7/metasploit-framework
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 88/100
rapid7/metasploit-framework#21669 · 2 comments · 1 reaction ·
-
suggestion-docs
Difficulty 1/5 Under an hour Newbie friendliness 76/100
rapid7/metasploit-framework#21503 · 2 comments ·
-
suggestion-docs
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
rapid7/metasploit-framework#20663 ·
-
Difficulty 3/5 1-2 days Newbie friendliness 72/100
rapid7/metasploit-framework#21919 ·
-
suggestion-module
rapid7/metasploit-framework#21907 · 1 comment · 1 assignee ·
All issues in rapid7/metasploit-framework
Similar issues
-
バグ
Difficulty 1/5 Under an hour Newbie friendliness 92/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
voxpupuli/puppet-epel#186 · 1 comment ·
-
external_created_at is no longer used for the message timestamp since the new message UI (v4.4.0) OpenBug Frontend
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
TheOdinProject/curriculum#31402 · 1 comment ·
-
bug
Difficulty 2/5 1-3 hours Newbie friendliness 78/100