CVE-2017-5244

Name of the Vulnerable Software and Affected Versions Metasploit versions prior to 4.14.0 (Update 2017061301)

Description A security issue allowed GET requests to stop running tasks, which should only be allowed via POST requests, as these actions change the service state. This could have enabled an attacker to stop running tasks by tricking an authenticated user into executing JavaScript.

Recommendations For versions prior to 4.14.0 (Update 2017061301), update to Metasploit 4.14.0 (Update 2017061301) to ensure that only POST requests, which include a secret token to prevent CSRF attacks, are allowed to stop tasks.