PT-2017-2784 · Supervisor+1 · Supervisor+1

Calum Hutton · Published 2017-08-07 · Updated 2024-04-08 · CVE-2017-11610

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Supervisor versions prior to 3.0.1 Supervisor versions 3.1.x prior to 3.1.4 Supervisor versions 3.2.x prior to 3.2.4 Supervisor versions 3.3.x prior to 3.3.3

Description The XML-RPC server in Supervisor allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups. This issue is also related to inadequate access control in the XML-RPC component of the Supervisor web server.

Recommendations For versions prior to 3.0.1, update to version 3.0.1 or later. For versions 3.1.x prior to 3.1.4, update to version 3.1.4 or later. For versions 3.2.x prior to 3.2.4, update to version 3.2.4 or later. For versions 3.3.x prior to 3.3.3, update to version 3.3.3 or later.

Exploit

Fix

Improper Access Control

Incorrect Default Permissions

Weakness Enumeration

CWE-284

CWE-276

Related Identifiers

ALT-PU-2016-3247

ALT-PU-2016-3248

ALT-PU-2017-3593

BDU:2017-02043

CVE-2017-11610

DLA-1047-1

DSA-3942-1

GHSA-X7C8-4X3H-874W

MGASA-2017-0263

PYSEC-2017-41

RHSA-2017:3005

Affected Products

Alt Linux

Supervisor

References · 51

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/supervisor_xmlrpc_exec.rb · Exploit
• 🔥 https://github.com/ysrc/xunfeng/blob/master/vulscan/vuldb/crack_supervisor_web.py · Exploit
• 🔥 https://github.com/yaunsky/CVE-2017-11610 · Exploit
• 🔥 https://exploit-db.com/exploits/42779 · Exploit
• https://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txt · Vendor Advisory
• https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txt · Vendor Advisory
• https://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txt · Vendor Advisory
• https://github.com/Supervisor/supervisor/issues/964 · Vendor Advisory
• https://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txt · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-11610 · Security Note
• https://lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ · Vendor Advisory
• https://osv.dev/vulnerability/ALPINE-CVE-2017-11610 · Vendor Advisory
• https://security.gentoo.org/glsa/201709-06 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2017-11610 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-02043 · Security Note