PT-2017-2784 · Supervisor+1 · Supervisor+1

Calum Hutton · Publicado 2017-08-07 · Atualizado 2024-04-08 · CVE-2017-11610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

Alta

Vetor base

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supervisor versions prior to 3.0.1 Supervisor versions 3.1.x prior to 3.1.4 Supervisor versions 3.2.x prior to 3.2.4 Supervisor versions 3.3.x prior to 3.3.3

Description The XML-RPC server in Supervisor allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. This issue is also related to inadequate access control in the XML-RPC component of the Supervisor web server.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 or later. For versions 3.1.x prior to 3.1.4, update to version 3.1.4 or later. For versions 3.2.x prior to 3.2.4, update to version 3.2.4 or later. For versions 3.3.x prior to 3.3.3, update to version 3.3.3 or later.

Exploit

Correção

Improper Access Control

Incorrect Default Permissions

Enumeração de Fraquezas

CWE-284

CWE-276

Identificadores relacionados

ALT-PU-2016-3247

ALT-PU-2016-3248

ALT-PU-2017-3593

BDU:2017-02043

CVE-2017-11610

DLA-1047-1

DSA-3942-1

GHSA-X7C8-4X3H-874W

MGASA-2017-0263

PYSEC-2017-41

RHSA-2017:3005

Produtos afetados

Alt Linux

Supervisor

Referências · 51

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/supervisor_xmlrpc_exec.rb · Exploit
• 🔥 https://github.com/ysrc/xunfeng/blob/master/vulscan/vuldb/crack_supervisor_web.py · Exploit
• 🔥 https://github.com/yaunsky/CVE-2017-11610 · Exploit
• 🔥 https://exploit-db.com/exploits/42779 · Exploit
• https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt · Aviso do Fabricante
• https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt · Aviso do Fabricante
• https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt · Aviso do Fabricante
• https://github.com/Supervisor/supervisor/issues/964 · Aviso do Fabricante
• https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt · Aviso do Fabricante
• https://github.com/Supervisor/supervisor · Nota
• https://github.com/pypa/advisory-database/tree/main/vulns/supervisor/PYSEC-2017-41.yaml · Nota
• https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11610 · Nota de Segurança
• https://lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ · Aviso do Fabricante
• https://osv.dev/vulnerability/ALPINE-CVE-2017-11610 · Aviso do Fabricante