CVE-2017-0907 Critical severity vulnerability that affects recurly-api-client
An SSRF vulnerability in the Recurly .NET library allows attackers to compromise API keys or access critical resources via improper URI escaping.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-0907?
CVE-2017-0907 is a critical server-side request forgery vulnerability in recurly-api-client .NET library, published on 13 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The Recurly Client .NET Library before 1.0.1, 1.1.10, 1.2.8, 1.3.2, 1.4.14, 1.5.3, 1.6.2, 1.7.1, 1.8.1 is vulnerable to a Server-Side Request Forgery vulnerability due to incorrect use of "Uri.EscapeUriString" that could result in compromise of API keys or other critical resources.
Weakness: CWE-918
Which versions are affected by CVE-2017-0907?
18 open source packages ship an affected version, including recurly-api-client. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
recurly-api-client NuGet | All versions | 1.0.1 |
recurly-api-client NuGet | All versions | 1.0.1 |
recurly-api-client NuGet | From 1.1.0 | 1.1.10 |
recurly-api-client NuGet | From 1.1.0 | 1.1.10 |
recurly-api-client NuGet | From 1.2.0 | 1.2.8 |
recurly-api-client NuGet | From 1.2.0 | 1.2.8 |
12 more packages
recurly-api-client NuGet | From 1.3.0 | 1.3.2 |
recurly-api-client NuGet | From 1.3.0 | 1.3.2 |
recurly-api-client NuGet | From 1.4.0 | 1.4.14 |
recurly-api-client NuGet | From 1.4.0 | 1.4.14 |
recurly-api-client NuGet | From 1.5.0 | 1.5.3 |
recurly-api-client NuGet | From 1.5.0 | 1.5.3 |
recurly-api-client NuGet | From 1.6.0 | 1.6.2 |
recurly-api-client NuGet | From 1.6.0 | 1.6.2 |
recurly-api-client NuGet | From 1.7.0 | 1.7.1 |
recurly-api-client NuGet | From 1.7.0 | 1.7.1 |
recurly-api-client NuGet | From 1.8.0 | 1.8.1 |
recurly-api-client NuGet | From 1.8.0 | 1.8.1 |
Products include Recurly Recurly Client .Net.
How do I fix CVE-2017-0907?
Upgrade recurly-api-client to a fixed version for your release line: 1.0.1, 1.1.10, 1.2.8 or 1.3.2.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-0907 being exploited?
There is no known exploitation of CVE-2017-0907 in the wild and no public exploit code.
Sources
Also known as GHSA-xpwp-rq3x-x6v7.