Description

The Metasploit Framework post module post/apple_ios/gather/ios_image_gather is affected by a relative path traversal vulnerability (CWE-22). The module interpolates file names taken from a Meterpreter directory listing — data fully controlled by a hostile or tampered iOS device — directly into the local destination path passed to client.fs.file.download_file(), with no sanitization. The underlying stdapi sink (lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb) writes to whatever path is supplied, so a listing entry such as ../../msfconsole.rc escapes the intended ~/.msf4/loot/<random> directory and overwrites ~/.msf4/msfconsole.rc, a resource file that every msfconsole invocation automatically executes at startup (lib/msf/ui/console/driver.rb:196). An attacker-controlled device that lures an operator into running this gather module achieves an arbitrary file write as the operator; because the written msfconsole.rc can load a second written file (a Ruby plugin whose top-level code runs on require), this converts into persistent code execution and an interactive shell as the operator (frequently root) on the pentester's workstation at the next console launch. The same traversal was previously fixed upstream in the recursive downloader (stdapi/fs/dir.rb scrubs separators); this module omitted the equivalent scrub. The fix applies the same separator scrub (or File.basename) to listing entries before building the local path.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "8.8",
  "pubDate": "2026-10-12T05:17:03.250Z",
  "pubdate": "2026-10-12T05:17:03.250Z",
  "executiveSummary": "The Metasploit Framework post/apple_ios/gather/ios_image_gather module contains a critical CWE-22 relative path traversal vulnerability. This flaw allows a compromised or malicious iOS device to execute arbitrary file write operations on the operator's host workstation.\nBy manipulating directory listing entries, an attacker can escape the intended loot directory and overwrite sensitive files, such as msfconsole.rc, within the user's ~/.msf4 directory. This vulnerability effectively enables an attacker to achieve persistent remote code execution on the workstation of the security professional running the module.\nThe vulnerability stems from the module's failure to sanitize filenames retrieved from an external, untrusted source before using them in file system operations. Because the Metasploit console automatically executes commands contained within ~/.msf4/msfconsole.rc upon startup, this represents a high-risk vector for workstation compromise. Successful exploitation requires the security operator to target or interact with a hostile device, subsequently leading to full system compromise of the operator's host machine with the privileges of the user running the Metasploit console.",
  "technicalDetails": "The root cause of this vulnerability is the improper handling of untrusted input during file download operations within the post/apple_ios/gather/ios_image_gather module. Specifically, the module fetches directory listings from a connected iOS device and directly uses the reported filenames to construct local destination paths via client.fs.file.download_file().\nThe underlying stdapi sink located in lib/rex/post/meterpreter/extensions/stdapi/fs/file.rb does not perform path sanitization, allowing the use of relative path traversal sequences such as '../'. When a malicious device provides a filename like '../../msfconsole.rc', the module writes the downloaded data outside the designated loot directory (typically ~/.msf4/loot/<random>/).\nThe attack flow proceeds as follows: First, an operator connects to a compromised or malicious iOS device. Second, the operator executes the vulnerable post/apple_ios/gather/ios_image_gather module. Third, the module queries the device for a directory listing. The malicious device returns a crafted filename entry containing traversal characters. Fourth, the module concatenates this entry to the destination path and invokes the file download function. This results in the overwriting of ~/.msf4/msfconsole.rc, which is automatically parsed and executed by lib/msf/ui/console/driver.rb at startup.\nAn attacker can leverage this primitive to write a secondary malicious Ruby plugin file to the local disk. By configuring the overwritten msfconsole.rc to require this plugin, the attacker triggers arbitrary Ruby code execution whenever the pentester launches the Metasploit console. Because msfconsole is often run with elevated privileges (e.g., sudo msfconsole), the attacker gains persistent code execution and an interactive shell on the operator's workstation with the privileges of the console user.\nThis vulnerability is particularly severe because it bypasses the implicit trust model between the operator and the target device. While previous iterations of the Metasploit framework addressed similar traversal issues in the recursive downloader by implementing path scrubbing in stdapi/fs/dir.rb, the post/apple_ios/gather/ios_image_gather module failed to implement these equivalent security controls."
}