Sign upLogin

rapid7/metasploit-framework

View on GitHub
Star

Showing 7,361 of 22,177 total issues

Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
Open

  def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'Cisco IOX XE unauthenticated Command Line Interface (CLI) execution',
Severity: Major
Found in modules/auxiliary/admin/http/cisco_ios_xe_cli_exec_cve_2023_20198.rb - About 2 hrs to fix

    Method run has 66 lines of code (exceeds 25 allowed). Consider refactoring.
    Open

      def run
    user = datastore['USERNAME']
    pass = datastore['PASSWORD']
    trust_store = datastore['TRUST_STORE']
    Severity: Major
    Found in modules/auxiliary/admin/http/nexpose_xxe_file_read.rb - About 2 hrs to fix

      Method run_host has 66 lines of code (exceeds 25 allowed). Consider refactoring.
      Open

        def run_host(ip)
    os = datastore['OS']
    data = '<?xml version="1.0" encoding="utf-8" ?>'
    data << '<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">'
    data << '<env:Body>'
      Severity: Major
      Found in modules/auxiliary/scanner/sap/sap_soap_rfc_sxpg_call_system_exec.rb - About 2 hrs to fix

        Method run_host has 66 lines of code (exceeds 25 allowed). Consider refactoring.
        Open

          def run_host(ip)
    data = '<?xml version="1.0" encoding="utf-8" ?>'
    data << '<env:Envelope xmlns:xsd="http://www.w3.org/2001/XMLSchema" xmlns:env="http://schemas.xmlsoap.org/soap/envelope/" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance">'
    data << '<env:Body>'
    data << '<n1:BAPI_USER_CREATE1 xmlns:n1="urn:sap-com:document:sap:rfc:functions" env:encodingStyle="http://schemas.xmlsoap.org/soap/encoding/">'
        Severity: Major
        Found in modules/auxiliary/scanner/sap/sap_soap_bapi_user_create1.rb - About 2 hrs to fix

          Method php_reverse_shell has 66 lines of code (exceeds 25 allowed). Consider refactoring.
          Open

            def php_reverse_shell

    if (!datastore['LHOST'] or datastore['LHOST'].empty?)
      # datastore is empty on msfconsole startup
      ipaddr = '127.0.0.1'
          Severity: Major
          Found in modules/payloads/singles/php/reverse_php.rb - About 2 hrs to fix

            Method generate has 66 lines of code (exceeds 25 allowed). Consider refactoring.
            Open

              def generate(opts={})
      # 22 -> "0x00,0x16"
      # 4444 -> "0x11,0x5c"
      tcp_port = convert_input(datastore['LPORT'], 4)
            Severity: Major
            Found in modules/payloads/singles/linux/x64/shell_reverse_ipv6_tcp.rb - About 2 hrs to fix

              Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
              Open

                def initialize(info = {})
    super(merge_info(info,
      'Name'          => 'Reverse TCP Stager',
      'Description'   => 'Connect back to the attacker',
      'Author'        => 'hdm',
              Severity: Major
              Found in modules/payloads/stagers/osx/armle/reverse_tcp.rb - About 2 hrs to fix

                Method exploit has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                Open

                  def exploit
    print_status("Getting login credentials...")
    res = send_traversal_query(traversal_path("conf/localconfig.xml"))

    unless res and res.code == 200
                Severity: Major
                Found in modules/exploits/unix/webapp/zimbra_lfi.rb - About 2 hrs to fix

                  Method exploit has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                  Open

                    def exploit
    print_status("Checking for a valid node id...")
    node_id = get_node
    if node_id.nil?
      print_error("node id not found")
                  Severity: Major
                  Found in modules/exploits/unix/webapp/vbulletin_vote_sqli_exec.rb - About 2 hrs to fix

                    Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                    Open

                      def initialize(info = {})
    super(update_info(info,
      'Name'            => 'Pure-FTPd External Authentication Bash Environment Variable Code Injection (Shellshock)',
      'Description'     => %q(
        This module exploits the Shellshock vulnerability, a flaw in how the Bash shell
                    Severity: Major
                    Found in modules/exploits/multi/ftp/pureftpd_bash_env_exec.rb - About 2 hrs to fix

                      Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                      Open

                        def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Apache Tomcat Manager Application Deployer Authenticated Code Execution',
      'Description'    => %q{
          This module can be used to execute a payload on Apache Tomcat servers that
                      Severity: Major
                      Found in modules/exploits/multi/http/tomcat_mgr_deploy.rb - About 2 hrs to fix

                        Method upload_php has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                        Open

                          def upload_php(base, opts)
    fname = opts['filename']
    php_payload = opts['data']
    user_id = opts['user_id']
    email = opts['email']
                        Severity: Major
                        Found in modules/exploits/multi/http/qdpm_authenticated_rce.rb - About 2 hrs to fix

                          Method exploit has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                          Open

                            def exploit

    print_status("Login with the provided credentials...")

    res = send_request_cgi({
                          Severity: Major
                          Found in modules/exploits/multi/http/mutiny_subnetmask_exec.rb - About 2 hrs to fix

                            Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                            Open

                              def initialize( info = {} )
    super( update_info( info,
      'Name'           => 'Java AtomicReferenceArray Type Violation Vulnerability',
      'Description'    => %q{
          This module exploits a vulnerability due to the fact that
                            Severity: Major
                            Found in modules/exploits/multi/browser/java_atomicreferencearray.rb - About 2 hrs to fix

                              Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                              Open

                                def initialize( info = {} )
    super( update_info( info,
      'Name'           => 'Java Applet Field Bytecode Verifier Cache Remote Code Execution',
      'Description'    => %q{
          This module exploits a vulnerability in HotSpot bytecode verifier where an invalid
                              Severity: Major
                              Found in modules/exploits/multi/browser/java_verifier_field_access.rb - About 2 hrs to fix

                                Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                                Open

                                  def initialize
    super(
      'Name' => 'PXE Exploit Server',
      'Description' => %q{
        This module provides a PXE server, running a DHCP and TFTP server.
                                Severity: Major
                                Found in modules/exploits/windows/local/pxeexploit.rb - About 2 hrs to fix

                                  Method check has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                                  Open

                                    def check
    version = get_version_info
    if version.windows_server?
      vprint_good('OS seems vulnerable.')
    else
                                  Severity: Major
                                  Found in modules/exploits/windows/local/dnsadmin_serverlevelplugindll.rb - About 2 hrs to fix

                                    Method xml_payload has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                                    Open

                                      def xml_payload(cmd)
    %|<parameters>
        <parameter name="">
            <ArrayOfstring z:Id="1" z:Type="System.Collections.Generic.SortedSet`1[[System.String, mscorlib, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089]]" z:Assembly="System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089"
                xmlns="http://schemas.microsoft.com/2003/10/Serialization/Arrays"
                                    Severity: Major
                                    Found in modules/exploits/windows/http/sitecore_xp_cve_2021_42237.rb - About 2 hrs to fix

                                      Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                                      Open

                                        def initialize(info = {})
    super(
      update_info(
        info,
        'Name' => 'ManageEngine ADManager Plus ChangePasswordAction Authenticated Command Injection',
                                      Severity: Major
                                      Found in modules/exploits/windows/http/manageengine_admanager_plus_cve_2023_29084_auth_cmd_injection.rb - About 2 hrs to fix

                                        Method initialize has 66 lines of code (exceeds 25 allowed). Consider refactoring.
                                        Open

                                          def initialize(info={})
    super(update_info(info,
      'Name'        => "VLC MMS Stream Handling Buffer Overflow",
      'Description' => %q{
          This module exploits a buffer overflow in VLC media player VLC media player prior
                                        Severity: Major
                                        Found in modules/exploits/windows/browser/vlc_mms_bof.rb - About 2 hrs to fix
                                          Severity
                                          Category
                                          Status
                                          Source
                                          Language