CVE-2017-5244

Routes used to stop running Metasploit tasks (either particular ones or all tasks) allowed GET requests. Only POST requests should have been allowed, as the stop/stop_all routes change the state of the service. This could have allowed an attacker to stop currently-running Metasploit tasks by getting an authenticated user to execute JavaScript. As of Metasploit 4.14.0 (Update 2017061301), the routes for stopping tasks only allow POST requests, which validate the presence of a secret token to prevent CSRF attacks.

• CWE-352
• CWE-352

• http://www.securityfocus.com/bid/99082Third Party Advisory, VDB Entry
• https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixedExploit, VDB Entry, Vendor Advisory
• https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/Third Party Advisory
• http://www.securityfocus.com/bid/99082Third Party Advisory, VDB Entry
• https://community.rapid7.com/community/metasploit/blog/2017/06/15/r7-2017-16-cve-2017-5244-lack-of-csrf-protection-for-stopping-tasks-in-metasploit-pro-express-and-community-editions-fixedExploit, VDB Entry, Vendor Advisory
• https://www.seekurity.com/blog/general/metasploit-web-project-kill-all-running-tasks-csrf-CVE-2017-5244/Third Party Advisory

Published

Jun 15, 2017

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2017-5238Due to a lack of bounds checking, several input configuratio…
• CVE-2017-5239Due to a lack of standard encryption when transmitting sensi…
• CVE-2017-5240Editions of Rapid7 AppSpider Pro prior to version 6.14.060 c…
• CVE-2017-5241Biscom Secure File Transfer versions 5.0.0.0 trough 5.1.1024…
• CVE-2017-5242Nexpose and InsightVM virtual appliances downloaded between …7.7
• CVE-2017-5243The default SSH configuration in Rapid7 Nexpose hardware app…
• CVE-2017-5245Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultI…
• CVE-2017-5246Biscom Secure File Transfer is vulnerable to AngularJS expre…
• CVE-2017-5247Biscom Secure File Transfer is vulnerable to cross-site scri…
• CVE-2017-5249In version 6.1.0.19 and prior of Wink Labs's Wink - Smart Ho…
• CVE-2017-5250In version 1.9.7 and prior of Insteon's Insteon for Hub Andr…
• CVE-2017-5251In version 1012 and prior of Insteon's Insteon Hub, the radi…