Rapid7 Nexpose up to 6.4.65 Web Application HTTP Requests cross-site request forgery

Summaryinfo

A vulnerability was found in Rapid7 Nexpose up to 6.4.65. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the component Web Application. Executing a manipulation as part of HTTP Requests can lead to cross-site request forgery. The identification of this vulnerability is CVE-2017-5264. The attack may be launched remotely. Furthermore, there is an exploit available. It is recommended to upgrade the affected component.

Detailsinfo

A vulnerability has been found in Rapid7 Nexpose up to 6.4.65 and classified as problematic. This vulnerability affects some unknown processing of the component Web Application. The manipulation as part of a HTTP Requests leads to a cross-site request forgery vulnerability. The CWE definition for the vulnerability is CWE-352. The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request. As an impact it is known to affect integrity. CVE summarizes:

Versions of Nexpose prior to 6.4.66 fail to adequately validate the source of HTTP requests intended for the Automated Actions administrative web application, and are susceptible to a cross-site request forgery (CSRF) attack.

The bug was discovered 12/13/2017. The weakness was shared 12/14/2017 (Website). The advisory is shared for download at help.rapid7.com. This vulnerability was named CVE-2017-5264 since 01/09/2017. The attack can be initiated remotely. No form of authentication is required for a successful exploitation. Successful exploitation requires user interaction by the victim. Technical details are unknown but a public exploit is available.

It is possible to download the exploit at exploit-db.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 1 days. During that time the estimated underground price was around $0-$5k.

Upgrading to version 6.4.66 eliminates this vulnerability.

The vulnerability is also documented in the databases at Exploit-DB (43911) and SecurityFocus (BID 102208†). VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Vendor

• Rapid7

Name

• Nexpose

Version

• 6.4.0
• 6.4.1
• 6.4.2
• 6.4.3
• 6.4.4
• 6.4.5
• 6.4.6
• 6.4.7
• 6.4.8
• 6.4.9
• 6.4.10
• 6.4.11
• 6.4.12
• 6.4.13
• 6.4.14
• 6.4.15
• 6.4.16
• 6.4.17
• 6.4.18
• 6.4.19
• 6.4.20
• 6.4.21
• 6.4.22
• 6.4.23
• 6.4.24
• 6.4.25
• 6.4.26
• 6.4.27
• 6.4.28
• 6.4.29
• 6.4.30
• 6.4.31
• 6.4.32
• 6.4.33
• 6.4.34
• 6.4.35
• 6.4.36
• 6.4.37
• 6.4.38
• 6.4.39
• 6.4.40
• 6.4.41
• 6.4.42
• 6.4.43
• 6.4.44
• 6.4.45
• 6.4.46
• 6.4.47
• 6.4.48
• 6.4.49
• 6.4.50
• 6.4.51
• 6.4.52
• 6.4.53
• 6.4.54
• 6.4.55
• 6.4.56
• 6.4.57
• 6.4.58
• 6.4.59
• 6.4.60
• 6.4.61
• 6.4.62
• 6.4.63
• 6.4.64
• 6.4.65

License

• commercial

CPE 2.3info

• 🔍
• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion