CVE-2017-11610 Incorrect Default Permissions in Supervisor
Remote authenticated users can execute arbitrary commands on Supervisor via crafted XML-RPC requests due to namespace lookup flaws.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-11610?
CVE-2017-11610 is a high-severity command injection vulnerability in Debian Debian Linux, published on 23 Aug 2017. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Weakness: CWE-276
Which versions are affected by CVE-2017-11610?
9 open source packages ship an affected version, including supervisor. It affects 4 products.
| Package | Affected | Fixed in |
|---|---|---|
supervisor PyPI | All versions | 3.0.1, 3.1.4, 3.2.4, 3.3.3 |
supervisor PyPI | All versions | 3.0.1 |
supervisor PyPI | All versions | 3.0.1 |
supervisor PyPI | From 3.1.0 | 3.1.4 |
supervisor PyPI | From 3.1.0 | 3.1.4 |
supervisor PyPI | From 3.2.0 | 3.2.4 |
3 more packages
supervisor PyPI | From 3.2.0 | 3.2.4 |
supervisor PyPI | From 3.3.0 | 3.3.3 |
supervisor PyPI | From 3.3.0 | 3.3.3 |
Products include Debian Debian Linux, Fedoraproject Fedora, Redhat Cloudforms, Supervisord Supervisor.
How do I fix CVE-2017-11610?
Upgrade supervisor to a fixed version for your release line: 3.0.1, 3.1.4, 3.2.4 or 3.3.3.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2017-11610 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2017-11610 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 4 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as ALPINE-CVE-2017-11610, DEBIAN-CVE-2017-11610, DLA-1047-1, DSA-3942-1, GHSA-x7c8-4x3h-874w, MGASA-2017-0263 and 2 more.