Command Injection in Supervisor - CVE-2017-11610
Published: January 15, 2019 / Updated: January 15, 2019
Vulnerability identifier: #VU16974
CSH Severity: Low
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-11610
CWE-ID: CWE-77
Exploitation vector: Remote access
Exploit availability:
Public exploit is available
Vulnerability details
The vulnerability allows a remote authenticated attacker to execute arbitrary commands on the target system.
The vulnerability exists in the XML-RPC server due to insufficient validation of user-supplied input. A remote attacker can execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Affected software
Supervisor
Juniper ATP
Gentoo Linux
Fedora
supervisor (Alpine package)
supervisor
Juniper ATP
Gentoo Linux
Fedora
supervisor (Alpine package)
supervisor
How to mitigate CVE-2017-11610
Install updates from vendor's website.
Supervisor - addressed in versions 3.0.1, 3.1.4, 3.2.4, 3.3.3
Juniper ATP - update to 5.0.3
supervisor (Alpine package) - update to 3.1.4-r0
supervisor - addressed in versions 3.1.4-1.el7, 3.1.4-1.fc24, 3.2.4-1.fc25, 3.3.3-1.fc26
Juniper ATP - update to 5.0.3
supervisor (Alpine package) - update to 3.1.4-r0
supervisor - addressed in versions 3.1.4-1.el7, 3.1.4-1.fc24, 3.2.4-1.fc25, 3.3.3-1.fc26
Links to Public Exploits and PoC-codes
- Exploit #2053 - CVE-2017-11610 (Standalone Python ≥3.6 RCE Unauthenticated exploit for Supervisor 3.0a1 to 3.3.2) (March 18, 2020)
- Exploit #1436 - Supervisor 3.0a1 < 3.3.2 - XML-RPC Authenticated Remote Code Execution (Metasploit) (March 18, 2020)
- Exploit #1820 - Supervisor XML-RPC Authenticated Remote Code Execution (March 18, 2020)