Run Metasploit in check-only mode for a specific CVE. No payload is staged. No session is opened. The module's check() method is called — it returns Safe/Vulnerable/Unknown. Guardrail gates: session required, ROE, module whitelist, rate limit.
(
self,
cve_id: str,
target: str,
port: int,
extra_options: dict | None = None,
)
| 75 | ) |
| 76 | self._connected = False |
| 77 | |
| 78 | # ── Public API ───────────────────────────────────────────────────────────── |
| 79 | |
| 80 | async def check_cve( |
| 81 | self, |
| 82 | cve_id: str, |
| 83 | target: str, |
| 84 | port: int, |
| 85 | extra_options: dict | None = None, |
| 86 | ) -> ExploitResult: |
| 87 | """ |
| 88 | Run Metasploit in check-only mode for a specific CVE. |
| 89 | |
| 90 | No payload is staged. No session is opened. The module's check() |
| 91 | method is called — it returns Safe/Vulnerable/Unknown. |
| 92 | |
| 93 | Guardrail gates: session required, ROE, module whitelist, rate limit. |
| 94 | """ |
| 95 | ref = lookup(cve_id) |
| 96 | if not ref: |
| 97 | return ExploitResult( |
| 98 | cve_id=cve_id, target=target, port=port, module_path="", |
| 99 | status="NO_MODULE", |
| 100 | error=f"No Metasploit module mapped for {cve_id}", |
| 101 | ) |
| 102 | |
| 103 | if not ref.safe_check: |
| 104 | return ExploitResult( |
| 105 | cve_id=cve_id, target=target, port=port, |
| 106 | module_path=ref.module_path, |
| 107 | status="BLOCKED", |
| 108 | error=( |
| 109 | f"Module {ref.module_path} does not implement check() — " |
| 110 | "live exploitation would be required. " |
| 111 | "Create session with allow_live_exploitation=True and call exploit_live()." |
| 112 | ), |
| 113 | ) |
| 114 | |
| 115 | # Guardrail gate |
| 116 | allowed, reason = guardrails.gate_exploit(target, ref.module_path, live=False) |
| 117 | if not allowed: |
| 118 | return ExploitResult( |
| 119 | cve_id=cve_id, target=target, port=port, |
| 120 | module_path=ref.module_path, |
| 121 | status="BLOCKED", |
| 122 | error=reason, |
| 123 | ) |
| 124 | |
| 125 | return await self._run_check(ref, target, port, extra_options or {}) |
no test coverage detected