VDB
CVE-2017-5244
CVE-2017-5244
PUBLISHED
CVSS 3.5 LOW
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.
EPSS 0.20% · 42.3th percentile
Risk Scores
CVSS 2.0
3.5
EPSS Score
0.20%
42.3th percentile
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Rapid7 | Metasploit (Pro, Express, and Community editions) | < 4.14.0 (Update 2017061301) |
| rapid7 | metasploit | 0 |
Timeline
- Jun 15, 2017 CVE Published
- Apr 14, 2021 EPSS Score
- Jun 23, 2021 EPSS Score
- Aug 24, 2021 EPSS Score
- Oct 26, 2021 EPSS Score
- Dec 27, 2021 EPSS Score
- Feb 28, 2022 EPSS Score
- May 2, 2022 EPSS Score
- Jul 3, 2022 EPSS Score
- Sep 5, 2022 EPSS Score
- Nov 6, 2022 EPSS Score
- Jan 8, 2023 EPSS Score
References
- 99082 vdb
- https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed url
- https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/ url
- https://nvd.nist.gov/vuln/detail/CVE-2017-5244 advisory
- https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244 url