CSRF Vulnerability in Metasploit Pro and Express Editions by Rapid7

CVE-2017-5244

What is CVE-2017-5244?

This vulnerability arises from the ability of GET requests to terminate active Metasploit tasks, which ideally should only respond to POST requests. By exploiting this flaw, an attacker could potentially convince an authenticated user to execute malicious JavaScript, leading to the unauthorized termination of running tasks. As of Metasploit version 4.14.0, this issue has been mitigated by restricting task-stopping routes to POST requests that require a valid secret token, effectively preventing CSRF attacks.

References