CVE-2017-11610
published 2017-08-23CVE-2017-11610: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute…
PriorityP188high8.8CVSS 3.0
AVNACLPRLUINSUCHIHAH
ITWEXPLOITVulnCheck KEVInitial access
Exploited in the wild
EPSS
87.38%
99.7th percentile
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Affected
27 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | supervisor | < supervisor 3.3.1-1.1 (bookworm) | supervisor 3.3.1-1.1 (bookworm) |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| fedoraproject | fedora | — | — |
| redhat | cloudforms | — | — |
| supervisord | supervisor | <= 3.0 | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | — | — |
| supervisord | supervisor | >= 0 < 3.3.1-1.1 | 3.3.1-1.1 |
| supervisord | supervisor | >= 0 < 3.3.1-1.1 | 3.3.1-1.1 |
| supervisord | supervisor | >= 0 < 3.3.1-1.1 | 3.3.1-1.1 |
| supervisord | supervisor | >= 0 < 3.3.1-1.1 | 3.3.1-1.1 |
| supervisord | supervisor | >= 0 < 3.0.1 | 3.0.1 |
| supervisord | supervisor | >= 3.1.0 < 3.1.4 | 3.1.4 |
Detection & IOCsextracted from sources · hover to see the quote
sigma↗
POST /RPC2 HTTP/1.1 with body containing supervisor.supervisord.options.warnings.linecache.os.system
- →Look for HTTP POST requests to /RPC2 on port 9001 containing the nested namespace traversal string 'supervisor.supervisord.options.warnings.linecache.os.system' in the XML body — this is the core exploit payload. ↗
- →Shodan/FOFA queries 'http.title:"Supervisor Status"' and 'title="supervisor status"' can identify exposed supervisord instances for asset inventory and attack surface reduction. ↗
- →Monitor for DNS interactions triggered by XML-RPC payloads to /RPC2 — the Nuclei template uses out-of-band DNS (interactsh) to confirm exploitation. ↗
- →Detect base64-encoded commands piped to bash via nohup in process execution logs — this is the command execution pattern used by the Metasploit module to detach and background the payload. ↗
- ·Exploitation requires authentication OR supervisord configured to run an HTTP server without authentication — unauthenticated exposure significantly increases risk. ↗
- ·Commands executed by the exploit run as the same OS user as supervisord — if supervisord runs as root, the attacker gains root-level command execution. ↗
- ·Affected versions span 3.0a1 through 3.3.2; fixed in 3.0.1, 3.1.4, 3.2.4, and 3.3.3 — version detection alone is insufficient if patch level is not confirmed. ↗
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
osv8.8HIGH
vulncheck8.8HIGH
vendor_debian8.8HIGH
vendor_redhat8.8HIGH
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
supervisor: Command injection via malicious XML-RPC request
vendor_redhat·2017-07-24·CVSS 8.8
CVE-2017-11610 [HIGH] CWE-77 supervisor: Command injection via malicious XML-RPC request
supervisor: Command injection via malicious XML-RPC request
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
A vulnerability was found in the XML-RPC interface in supervisord. When processing malformed commands, an attacker can cause arbitrary shell commands to be executed on the server as the same user as supervisord. Exploitation requires the attacker to first be authenticated to the supervisord service.
Package: supervisor (Red Hat Ceph Storage 1.3) - Will not fix
Package: supervisor (Red Hat Ceph Storage 2) - Will not fix
Package: nagios (Red Hat Mobile Application Platform 4) -
Debian
CVE-2017-11610: supervisor - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before ...
vendor_debian·2017·CVSS 8.8
CVE-2017-11610 [HIGH] CVE-2017-11610: supervisor - The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before ...
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Scope: local
bookworm: resolved (fixed in 3.3.1-1.1)
bullseye: resolved (fixed in 3.3.1-1.1)
forky: resolved (fixed in 3.3.1-1.1)
sid: resolved (fixed in 3.3.1-1.1)
trixie: resolved (fixed in 3.3.1-1.1)
GHSA
Incorrect Default Permissions in Supervisor
ghsa·2022-05-13
CVE-2017-11610 [HIGH] CWE-276 Incorrect Default Permissions in Supervisor
Incorrect Default Permissions in Supervisor
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
OSV
Incorrect Default Permissions in Supervisor
osv·2022-05-13
CVE-2017-11610 [HIGH] Incorrect Default Permissions in Supervisor
Incorrect Default Permissions in Supervisor
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
OSV
CVE-2017-11610: The XML-RPC server in supervisor before 3
osv·2017-08-23·CVSS 8.8
CVE-2017-11610 [HIGH] CVE-2017-11610: The XML-RPC server in supervisor before 3
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
VulnCheck
supervisord supervisor Incorrect Default Permissions
vulncheck·2017·CVSS 8.8
CVE-2017-11610 [HIGH] supervisord supervisor Incorrect Default Permissions
supervisord supervisor Incorrect Default Permissions
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisord namespace lookups.
Affected: supervisord supervisor
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://blogs.juniper.net/en-us/threat-research/sysrv-botnet-expands-and-gains-persistence; https://www.lacework.com/blog/sysrv-hello-expands-infrastructure/; https://www.bleepingcomputer.com/news/security/new-cryptomining-malware-builds-an-army-of-windows-linux-bots/; https
No detection rules found.
Exploit-DB
Supervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)
exploitdb·2017-09-25·CVSS 8.8
CVE-2017-11610 [HIGH] Supervisor 3.0a1 < 3.3.2 - XML-RPC (Authenticated) Remote Code Execution (Metasploit)
Supervisor 3.0a1 "Supervisor XML-RPC Authenticated Remote Code Execution",
'Description' => %q{
This module exploits a vulnerability in the Supervisor process control software, where an authenticated client
can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server.
The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this
may be root. This vulnerability can only be exploited by an authenticated client, or if supervisord has been
configured to run an HTTP server without authentication. This vulnerability affects versions 3.0a1 to 3.3.2.
},
'License' => MSF_LICENSE,
'Author' =>
[
'Calum Hutton '
],
'References' =>
[
['URL', 'https://github.com/Supervisor/supervisor/issues/964'],
['URL', 'htt
Metasploit
Supervisor XML-RPC Authenticated Remote Code Execution
metasploit
Supervisor XML-RPC Authenticated Remote Code Execution
Supervisor XML-RPC Authenticated Remote Code Execution
This module exploits a vulnerability in the Supervisor process control software, where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root. This vulnerability can only be exploited by an authenticated client, or if supervisord has been configured to run an HTTP server without authentication. This vulnerability affects versions 3.0a1 to 3.3.2.
Nuclei
XML-RPC Server - Remote Code Execution
nuclei·CVSS 8.8
CVE-2017-11610 [HIGH] XML-RPC Server - Remote Code Execution
XML-RPC Server - Remote Code Execution
The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups.
Template:
id: CVE-2017-11610
info:
name: XML-RPC Server - Remote Code Execution
author: notnotnotveg
severity: high
description: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nested supervisor namespace lookups.
impact: |
Successful exploitation of this vulnerability could allow an attacker to execute arbitrary code on the target sy
Tenable
Critical Vulnerability Fixes Available For Juniper Devices
blogs_tenable·2019-01-10
Critical Vulnerability Fixes Available For Juniper Devices
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Tenable
Critical Vulnerability Fixes Available For Juniper Devices
blogs_tenable·2019-01-10·CVSS 9.8
[CRITICAL] Critical Vulnerability Fixes Available For Juniper Devices
Blog / Cyber Exposure Alerts
Subscribe
# Critical Vulnerability Fixes Available For Juniper Devices
Ryan Seguin
January 10, 2019
2 Min Read
Juniper has addressed multiple critical vulnerabilities in Junos, Junos Space, and JATP devices. Administrators are advised to update to the latest OS version on any affected Juniper device.
## Background
Juniper has released a number of security advisories this week which include critical vulnerabilities across many of its devices. The Juniper Advanced Threat Prevention Appliance (JATP) update removes hardcoded admin credentials, while the Junos updates include patches for remote code execution (RCE) and denial of service (DoS) vulnerabilities. Junos Space network management devices are also vulnerable to a memory allocation vulnerability which
Greynoiseio
Malicious Tag Roundup (Sep 2-13, 2021)
blogs_greynoiseio
Malicious Tag Roundup (Sep 2-13, 2021)
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Find out immediately if an asset communicates with a malicious IP address
Vulnerability Prioritization Get real-time insight into active exploitation trends to better understand risk and severity
SOC Efficiency Filter out noisy, low priority and false-positive alerts from mass internet scanners
Incident Investigation Add context to incidents to speed the determinations of scope and timelines
Threat Hunting Quickly identify anomalous behavior and enrich your threat hunting campaigns
Why GreyNoise
CVE Disclosure Early Warning Get an early warning when traffic spikes indicate a high likelihood of new disclosures
Compromised Asset Detection Fin
Bugzilla
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [fedora-all]
bugzilla·2017-07-28·CVSS 8.8
CVE-2017-11610 [HIGH] CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [fedora-all]
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
Bugzilla
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [epel-all]
bugzilla·2017-07-28·CVSS 8.8
CVE-2017-11610 [HIGH] CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [epel-all]
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request [epel-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of epel-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported ve
Bugzilla
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request
bugzilla·2017-07-28·CVSS 8.8
CVE-2017-11610 [HIGH] CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request
CVE-2017-11610 supervisor: Command injection via malicious XML-RPC request
A vulnerability has been found where an authenticated client can send a malicious XML-RPC request to supervisord that will run arbitrary shell commands on the server. The commands will be run as the same user as supervisord. Depending on how supervisord has been configured, this may be root.
Upstream issue:
https://github.com/Supervisor/supervisor/issues/964
Upstream patches:
3.3.3 https://github.com/Supervisor/supervisor/commit/058f46141e346b18dee0497ba11203cb81ecb19e
3.2.4 https://github.com/Supervisor/supervisor/commit/aac3c21893cab7361f5c35c8e20341b298f6462e
3.1.4 https://github.com/Supervisor/supervisor/commit/dbe0f55871a122eac75760aef511efc3a8830b88
3.0.1 https://github.com/Supervisor/supervisor/commit/83
http://www.debian.org/security/2017/dsa-3942https://access.redhat.com/errata/RHSA-2017:3005https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txthttps://github.com/Supervisor/supervisor/issues/964https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/https://security.gentoo.org/glsa/201709-06https://www.exploit-db.com/exploits/42779/http://www.debian.org/security/2017/dsa-3942https://access.redhat.com/errata/RHSA-2017:3005https://github.com/Supervisor/supervisor/blob/3.0.1/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.1.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.2.4/CHANGES.txthttps://github.com/Supervisor/supervisor/blob/3.3.3/CHANGES.txthttps://github.com/Supervisor/supervisor/issues/964https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/4GMSCGMM477N64Z3BM34RWYBGSLK466B/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/DTPDZV4ZRICDYAYZVUHSYZAYDLRMG2IM/https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/JXGWOJNSWWK2TTWQJZJUP66FLFIWDMBQ/https://security.gentoo.org/glsa/201709-06https://www.exploit-db.com/exploits/42779/
2017-08-23
Published
Exploited in the wild