Skip to content

Fix the Rex HTTP Server#21636

Open
zeroSteiner wants to merge 4 commits into
rapid7:6.5from
zeroSteiner:fix/mc2-http-rpc-response
Open

Fix the Rex HTTP Server#21636
zeroSteiner wants to merge 4 commits into
rapid7:6.5from
zeroSteiner:fix/mc2-http-rpc-response

Conversation

@zeroSteiner

Copy link
Copy Markdown
Contributor

The Rex HTTP Server reads the context in the generic handler now. This breaks things in Pro because there's no context or exploit in the RPC server.

Includes basic tests to prevent regressions in the future.

@github-project-automation github-project-automation Bot moved this from Ready to In Progress in Metasploit Kanban Jul 3, 2026
# -*- coding: binary -*-
require 'uri'

require 'rex/text'

@adfoster-r7 adfoster-r7 Jul 7, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Is this needed? I think it should be covered by:

# Text manipulation library for things like generating random string
require 'rex/text'

Edit: I guess that you've added it because it's not included implicitly when running unit tests in isolation? 👀

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That's correct. I can't run the tests in isolation without that.

@zeroSteiner zeroSteiner force-pushed the fix/mc2-http-rpc-response branch from 0f72a03 to 2228196 Compare July 7, 2026 20:23
The context is now needed in the generic HTTP dispatch which is used by
Pro and thus outside the context of an exploit.
@zeroSteiner zeroSteiner force-pushed the fix/mc2-http-rpc-response branch from 2228196 to 2531106 Compare July 7, 2026 20:33
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

Status: In Progress

Development

Successfully merging this pull request may close these issues.

4 participants