Published: 15/06/2017 Updated: 09/10/2019

CVSS v2 Base Score: 3.5 | Impact Score: 2.9 | Exploitability Score: 6.8

CVSS v3 Base Score: 3.5 | Impact Score: 1.4 | Exploitability Score: 2.1

VMScore: 312

Vector: AV:N/AC:M/Au:S/C:N/I:N/A:P

Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an malicious user to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.

Vulnerable Product	Search on Vulmon	Subscribe to Product
rapid7 metasploit

Contents Cross Site Scripting (XSS) Cross Site Request Forgery (CSRF) Clickjacking (UI Redressing Attack) Local File Inclusion (LFI) Subdomain Takeover Denial of Service (DOS) Authentication Bypass SQL injection 2FA Related issues CORS Related issues Server Side Request Forgery (SSRF) Race Condition Remote Code Execution (RCE) Contributing Maintainers Cross Site Scripting (XS

Contents Cross Site Scripting (XSS) Cross Site Request Forgery (CSRF) Clickjacking (UI Redressing Attack) Local File Inclusion (LFI) Subdomain Takeover Denial of Service (DOS) Authentication Bypass SQL injection 2FA Related issues CORS Related issues Server Side Request Forgery (SSRF) Race Condition Remote Code Execution (RCE) Contributing Cross Site Scripting (XSS) From P5

CWE-352 https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed http://www.securityfocus.com/bid/99082 https://nvd.nist.gov https://github.com/xbl3/Awesome-Bugbounty-Writeups_devanshbatham

CVE-2017-5244

Vulnerability Summary

Vulnerability Trend

Github Repositories

References

Vulmon Search

About

Products

Connect