CVE-2017-0904 private_address_check vulnerable to bypass of Resolv.getaddresses method
The private_address_check gem fails to block private IPs due to OS-dependent DNS resolution, allowing attackers to bypass SSRF protections.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-0904?
CVE-2017-0904 is a high-severity server-side request forgery vulnerability in jtdowney private_address_check ruby gem, published on 13 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby's Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security measures, such as when used to blacklist private network addresses to prevent server-side request forgery.
Which versions are affected by CVE-2017-0904?
2 open source packages ship an affected version, including private_address_check. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
private_address_check RubyGems | All versions | 0.4.0 |
private_address_check RubyGems | All versions | 0.4.0 |
Products include Private Address Check Project Private Address Check.
How do I fix CVE-2017-0904?
Upgrade private_address_check to 0.4.0 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-0904 being exploited?
There is no known exploitation of CVE-2017-0904 in the wild and no public exploit code.
Other vulnerabilities in jtdowney private_address_check ruby gem
Sources
Also known as GHSA-hxhj-hp9m-qwc4.