PT-2017-16418 · Rapid7 · Metasploit

Mohamed A. Baset + 1 · Publicado 2017-06-15 · Atualizado 2019-10-09 · CVE-2017-5244

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Baixa

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Metasploit versions prior to 4.14.0 (Update 2017061301)

Description A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript.

Recommendations For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.

Exploit

Correção

CSRF

Enumeração de Fraquezas

CWE-352

Identificadores relacionados

CVE-2017-5244

Produtos afetados

Metasploit

Referências · 5

• 🔥 https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed · Exploit
• https://seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244 · Nota
• https://osv.dev/vulnerability/CVE-2017-5244 · Aviso do Fabricante
• http://securityfocus.com/bid/99082 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-5244 · Nota de Segurança