Remote Code Execution in Supervisor via XML-RPC

CVE-2017-11610 is a high-severity remote code execution (RCE) vulnerability affecting Supervisor process management software, specifically versions 3.3.2 and earlier. The vulnerability exists within the XML-RPC interface of the 'supervisord' server process. An attacker with network access to the XML-RPC endpoint (defaulting to TCP port 9001) can leverage the 'supervisord.options.warnings.linecache.os.system' method to inject and execute arbitrary commands on the underlying host. Successful exploitation runs the injected commands with the privileges of the Supervisor process, which is typically root. The availability of functional proof-of-concept (PoC) code significantly increases the risk to unpatched infrastructure, particularly systems with weak or default authentication configured for the XML-RPC interface.

Attack Chain

1. Attacker performs network reconnaissance to identify accessible Supervisor XML-RPC endpoints (typically port 9001).
2. Attacker interacts with the target service via HTTP POST requests directed at the '/RPC2' URI.
3. Attacker authenticates to the XML-RPC interface using weak, default, or empty credentials.
4. Attacker constructs a malicious XML payload targeting the 'supervisor.supervisord.options.warnings.linecache.os.system' method.
5. The Supervisor server-side process parses the malicious XML input without proper sanitization.
6. The underlying 'os.system' call executes the attacker-supplied command string on the host OS.
7. The attacker achieves code execution with the permissions of the 'supervisord' process (typically root).

Impact

Successful exploitation allows for full system compromise, as the 'supervisord' service generally operates with root privileges. Victims include any organization running exposed, unpatched versions of Supervisor (3.3.2 or earlier) that have not implemented robust authentication. With an EPSS score of 87.4%, the threat is widespread, and the vulnerability is trivial to exploit given network access and weak credentials.

Recommendation

• Immediately upgrade Supervisor to a patched version beyond 3.3.2 or implement strict network access control lists (ACLs) to limit access to port 9001.
• Enforce strong authentication for the XML-RPC interface and ensure no default or empty passwords exist.
• Monitor webserver logs for unauthorized POST requests to '/RPC2' containing XML payloads, specifically checking for method calls including 'linecache.os.system'.
• Disable the web interface if it is not required for operational tasks.