CVE-2017-0909 private_address_check contains Incomplete List of Disallowed Inputs
An attacker can bypass SSRF protections in the private_address_check Ruby gem due to an incomplete blacklist of private network addresses.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2017-0909?
CVE-2017-0909 is a critical server-side request forgery vulnerability in HackerOne private_address_check ruby gem, published on 16 Nov 2017. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.
Weakness: CWE-184
Which versions are affected by CVE-2017-0909?
2 open source packages ship an affected version, including private_address_check. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
private_address_check RubyGems | All versions | 0.4.1 |
private_address_check RubyGems | All versions | 0.4.1 |
Products include Private Address Check Project Private Address Check.
How do I fix CVE-2017-0909?
Upgrade private_address_check to 0.4.1 or later.
Upgrade, and send outbound requests through an allow-list that blocks internal addresses. More about Server-side request forgery.
Is CVE-2017-0909 being exploited?
There is no known exploitation of CVE-2017-0909 in the wild and no public exploit code.
Other vulnerabilities in HackerOne private_address_check ruby gem
Sources
Also known as GHSA-3v3c-r5v2-68ph.