CVE-2017-0889 paperclip Server-Side Request Forgery vulnerability
Attackers can exploit a Server-Side Request Forgery flaw in the Paperclip gem to access internal network resources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-0889?
CVE-2017-0889 is a critical server-side request forgery vulnerability in thoughtbot paperclip ruby gem, published on 13 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Paperclip ruby gem version 3.1.4 and later suffers from a Server-SIde Request Forgery (SSRF) vulnerability in the Paperclip::UriAdapter class. Attackers may be able to access information about internal network resources.
Weakness: CWE-918
Which versions are affected by CVE-2017-0889?
2 open source packages ship an affected version, including paperclip. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
paperclip RubyGems | From 3.1.4 | 5.2.0 |
paperclip RubyGems | From 3.1.4 | 5.2.0 |
Products include Thoughtbot Paperclip.
How do I fix CVE-2017-0889?
Upgrade paperclip to 5.2.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-0889 being exploited?
There is no known exploitation of CVE-2017-0889 in the wild and no public exploit code.
Other vulnerabilities in thoughtbot paperclip ruby gem
Sources
Also known as GHSA-5jcf-c5rg-rmm8.