CVE-2017-0905 Recurly gem Server-Side Request Forgery in Resource#find method

Critical 9.8 Published 13 Nov 2017 Updated 16 Sep 2024

An SSRF vulnerability in the Recurly Ruby library allows attackers to compromise API keys and access critical resources.

Exploited in the wild: Not known
Login needed: Not needed
Attackable: Over the internet
Victim action needed: Not needed
Fix: Available

What is CVE-2017-0905?

CVE-2017-0905 is a critical server-side request forgery vulnerability in recurly ruby gem, published on 13 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

Weakness: CWE-918

Which versions are affected by CVE-2017-0905?

24 open source packages ship an affected version, including recurly. It affects 1 product.

Package	Affected	Fixed in
`recurly` RubyGems	From `2.0.0`	`2.0.13`
`recurly` RubyGems	From `2.0.0`	`2.0.13`
`recurly` RubyGems	From `2.1.0`	`2.1.11`
`recurly` RubyGems	From `2.1.0`	`2.1.11`
`recurly` RubyGems	From `2.10.0`	`2.10.4`
`recurly` RubyGems	From `2.10.0`	`2.10.4`

18 more packages

`recurly` RubyGems	From `2.11.0`	`2.11.3`
`recurly` RubyGems	From `2.11.0`	`2.11.3`
`recurly` RubyGems	From `2.2.0`	`2.2.5`
`recurly` RubyGems	From `2.2.0`	`2.2.5`
`recurly` RubyGems	From `2.3.0`	`2.3.10`
`recurly` RubyGems	From `2.3.0`	`2.3.10`
`recurly` RubyGems	From `2.4.0`	`2.4.11`
`recurly` RubyGems	From `2.4.0`	`2.4.11`
`recurly` RubyGems	From `2.5.0`	`2.5.4`
`recurly` RubyGems	From `2.5.0`	`2.5.4`
`recurly` RubyGems	From `2.6.0`	`2.6.3`
`recurly` RubyGems	From `2.6.0`	`2.6.3`
`recurly` RubyGems	From `2.7.0`	`2.7.8`
`recurly` RubyGems	From `2.7.0`	`2.7.8`
`recurly` RubyGems	From `2.8.0`	`2.8.2`
`recurly` RubyGems	From `2.8.0`	`2.8.2`
`recurly` RubyGems	From `2.9.0`	`2.9.2`
`recurly` RubyGems	From `2.9.0`	`2.9.2`

Products include Recurly Recurly Client Ruby.

How do I fix CVE-2017-0905?

Upgrade recurly to a fixed version for your release line: 2.0.13, 2.1.11, 2.10.4 or 2.11.3.

Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.

Is CVE-2017-0905 being exploited?

There is no known exploitation of CVE-2017-0905 in the wild and no public exploit code.

Sources

Also known as GHSA-x27v-x225-gq8g.