← Vulnerability feed

Vulnerability record · CVE-2017-5244 · published 15 June 2017

CVE-2017-5244: Rapid7 metasploit cross-site request forgery vulnerability

Rapid7 · Metasploit

Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.

3.5 CVSS 3.0 Low EPSS 0.72% · top 48.0% CWE-352 · Cross-site request forgery
3.5CVSS 3.0 base score, v2 3.5
0.72%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
6References, 2 tagged exploit
17 Jun 2026Last modified by NVD

Description

Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:L

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://www.securityfocus.com/bid/99082 Third Party AdvisoryVDB Entry
https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-s ExploitVDB EntryVendor Advisory
https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/ Third Party Advisory
http://www.securityfocus.com/bid/99082 Third Party AdvisoryVDB Entry
https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-s ExploitVDB EntryVendor Advisory
https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/ Third Party Advisory

Track CVE-2017-5244 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

9.8CVE-2020-7376Rapid7 metasploit relative path traversal vulnerabilityThe Metasploit Framework module "post/osx/gather/enum_osx module" is affected by a relative path traversal vulnerability in the get_keychains method …EPSS 1.1%8.8CVE-2020-7385Rapid7 metasploit deserialization of untrusted data vulnerabilityBy launching the drb_remote_codeexec exploit, a Metasploit Framework user will inadvertently expose Metasploit to the same deserialization issue that…EPSS 1.8%7.8CVE-2020-7384Rapid7 metasploit command injection vulnerabilityRapid7's Metasploit msfvenom framework handles APK files in a way that allows for a malicious user to craft and publish a file that would execute arb…EPSS 30%7.8CVE-2020-7350Rapid7 metasploit os command injection vulnerabilityRapid7 Metasploit Framework versions before 5.0.85 suffers from an instance of CWE-78: OS Command Injection, wherein the libnotify plugin accepts unt…EPSS 5.0%7.8CVE-2017-5235Rapid7 metasploit untrusted search path vulnerabilityRapid7 Metasploit Pro installers prior to version 4.13.0-2017022101 contain a DLL preloading vulnerability, wherein it is possible for the installer …EPSS 0.91%7.5CVE-2019-5645Rapid7 metasploit uncontrolled resource consumption vulnerabilityBy sending a specially crafted HTTP GET request to a listening Rapid7 Metasploit HTTP handler, an attacker can register an arbitrary regular expressi…EPSS 42%7.5CVE-2020-7377Rapid7 metasploit relative path traversal vulnerabilityThe Metasploit Framework module "auxiliary/admin/http/telpho10_credential_dump" module is affected by a relative path traversal vulnerability in the …EPSS 1.1%7.3CVE-2019-5624Rapid7 metasploit path traversal vulnerabilityRapid7 Metasploit Framework suffers from an instance of CWE-22, Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in the…EPSS 2.8%

Source: NIST National Vulnerability Database (record CVE-2017-5244), CISA KEV, FIRST EPSS (scores of 2026-10-01). This page is refreshed as NVD updates the record.