CVE-2017-5244: CSRF
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stopall routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2017-5244?
CVE-2017-5244 is classified as a medium severity vulnerability due to the potential for unauthorized task interruption in Metasploit.
How do I fix CVE-2017-5244?
To mitigate CVE-2017-5244, ensure that only POST requests are accepted for the stop and stop_all routes in Metasploit.
What software versions are affected by CVE-2017-5244?
CVE-2017-5244 affects Rapid7 Metasploit versions up to and including 4.13.19.
What kind of attacks can CVE-2017-5244 facilitate?
CVE-2017-5244 can enable an attacker to stop currently-running Metasploit tasks via unauthorized GET requests.
Is CVE-2017-5244 related to CSRF vulnerabilities?
Yes, CVE-2017-5244 is related to a lack of CSRF protection for stopping tasks in Metasploit.