Critical Command Execution Vulnerability in Supervisor Package
Summary
ALPINE-CVE-2017-11610: The XML-RPC server in supervisor before 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 allows remote authenticated users to execute arbitrary commands via a crafted XML-RPC request, related to nest... Affects supervisor versions < 3.2.4-r0. Fixed in 3.2.4-r0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Supervisor package is a process control system that allows users to monitor and control a number of processes on UNIX-like operating systems. It provides a simple interface for managing processes, enabling automatic restarts, and logging. However, certain versions of Supervisor are vulnerable to a critical command execution flaw that can be exploited by remote authenticated users.
Vulnerability Detail
The vulnerability, identified as CVE-2017-11610, exists in the XML-RPC server of Supervisor prior to version 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3. It allows remote authenticated users to execute arbitrary commands through crafted XML-RPC requests, particularly exploiting nested supervisord namespace lookups. This can lead to unauthorized command execution, potentially compromising the system's integrity and security.
How To Fix
Minimum fixed version
3.2.4-r0
This is the first release that contains the fix.
sudo apk add --upgrade supervisorTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, you can disable the XML-RPC server in Supervisor if it is not needed for your application. This can be done by modifying the Supervisor configuration file to comment out or remove any XML-RPC related settings.
Conclusion
The CVE-2017-11610 vulnerability in the Supervisor package poses a significant risk, allowing remote authenticated users to execute arbitrary commands. It is crucial to update to the patched version to mitigate this risk and ensure the security of your systems.
See every vulnerability recorded for supervisor →
FAQ
CVE-2017-11610 is a vulnerability in the Supervisor package that allows remote authenticated users to execute arbitrary commands via crafted XML-RPC requests.
Versions of Supervisor prior to 3.0.1, 3.1.x before 3.1.4, 3.2.x before 3.2.4, and 3.3.x before 3.3.3 are affected by this vulnerability.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The CVSS score of CVE-2017-11610 is 8.8, indicating a high severity level.
If you cannot update the package immediately, consider disabling the XML-RPC server in your Supervisor configuration as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for supervisor.
