CVE-2017-5244
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have…
- Published
- Updated
- Reserved
- Assigned by
- rapid7
Description
Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.0 | Low3.5 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L |
- EPSS (exploitation in 30 days)
- 0.72% · top 46% of all CVEs (3 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Low 3.5.
Weakness
Affected products
Rapid7 · Metasploit (Pro, Express, and Community editions)
- affected < 4.14.0 (Update 2017061301)
References (3)
- 99082 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixed (opens in a new tab)x_refsource_CONFIRMx_transferred
- https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/ (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2017-5244)Record last updated .