PT-2017-16418 · Rapid7 · Metasploit

Mohamed A. Baset + 1 · Published 2017-06-15 · Updated 2019-10-09 · CVE-2017-5244

Positive Technologies (AI Summary)

CVSS v2.0

3.5

Low

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:P

Name of the Vulnerable Software and Affected Versions Metasploit versions prior to 4.14.0 (Update 2017061301)

Description A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript.

Recommendations For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2017-5244

Affected Products

Metasploit

References · 5

• 🔥 https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed · Exploit
• https://osv.dev/vulnerability/CVE-2017-5244 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-5244 · Security Note
• https://seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244 · Note
• http://securityfocus.com/bid/99082 · Note