Metasploit Framework before 6.5.7 does not restrict the destination of HTTP redirects, so an attacker can manipulate the framework to send requests to any server reachable from the operator’s machine. This opened internal services to a remote malicious HTTP server, potentially exposing confidential data or enabling further exploitation. The weakness is a classic Server‑Side Request Forgery (CWE‑918).

Rapid7 Metasploit Framework versions earlier than 6.5.7 are affected. The issue resides in the send_request_cgi! function which is part of the core framework, impacting all users running affected versions.

The CVSS score of 4.7 indicates a moderate overall risk. EPSS is not available, and the vulnerability is not listed in CISA KEV. Successful exploitation requires the attacker to control an HTTP server that the Metasploit process will contact and to trigger send_request_cgi!; once achieved, the framework will silently follow redirects to any host, including internal services. The likelihood of exploitation depends on network exposure and operator habit of making external requests.