Plattform
ruby
Komponente
recurly
Behoben in
2.3.10
CVE-2017-0905 is a Server-Side Request Forgery (SSRF) vulnerability discovered in the Recurly Client Ruby Library. This flaw allows attackers to potentially trigger unintended requests to internal or external resources, leading to the compromise of sensitive data. The vulnerability affects versions of the library up to and including 2.3.9. A fix is available in version 2.3.10.
The SSRF vulnerability in the Recurly Client Ruby Library allows an attacker to craft malicious requests that the library will execute on behalf of the application. This can be exploited to access internal resources that are not directly accessible from the outside, such as internal APIs or databases. A successful attack could result in the compromise of sensitive API keys used to authenticate with the Recurly platform. This, in turn, could allow the attacker to perform actions on the user's behalf, such as modifying subscriptions, creating new users, or accessing billing information. The blast radius extends to any application using the vulnerable Recurly Client Ruby Library, potentially impacting a wide range of users and systems.
CVE-2017-0905 was publicly disclosed on December 6, 2017. While no active exploitation campaigns have been definitively linked to this specific vulnerability, SSRF vulnerabilities are often targeted by attackers seeking to gain unauthorized access to internal resources. The vulnerability is not currently listed on the CISA KEV catalog. Public proof-of-concept exploits are available, increasing the risk of exploitation.
Applications built with Ruby that integrate with Recurly for subscription billing are at risk. This includes e-commerce platforms, SaaS providers, and any application relying on the Recurly Client Ruby Library for managing subscriptions. Legacy applications using older versions of the library are particularly vulnerable.
• ruby / application:
require 'recurly-client'
# Check version
Recurly::Client.version• ruby / gems:
gem list recurly-client• generic web:
curl -I https://your-application.com/recurly/resource/find?url=http://internal-service• generic web:
grep -A 10 'recurly-client' Gemfiledisclosure
Exploit-Status
EPSS
0.52% (67% Perzentil)
CVSS-Vektor
The primary mitigation for CVE-2017-0905 is to upgrade the Recurly Client Ruby Library to version 2.3.10 or later. If upgrading is not immediately feasible due to compatibility issues or breaking changes, consider implementing input validation and sanitization on any user-supplied data used in requests to the Recurly API. While not a complete fix, restricting outbound network access from the application server to only necessary domains can limit the potential impact of an SSRF attack. Monitor application logs for unusual outbound requests that might indicate exploitation attempts. After upgrading, confirm the fix by attempting to trigger the vulnerable Resource#find method with a malicious URL and verifying that the request is blocked or handled safely.
Kein offizieller Patch verfügbar. Prüfe auf Workarounds oder überwache auf Updates.
Schwachstellenanalysen und kritische Warnungen direkt in deinen Posteingang.
CVE-2017-0905 is a critical Server-Side Request Forgery vulnerability in the Recurly Client Ruby Library, allowing attackers to potentially access internal resources and compromise API keys.
You are affected if your Ruby application uses the Recurly Client Ruby Library version 2.3.9 or earlier. Upgrade to version 2.3.10 or later to mitigate the risk.
Upgrade the Recurly Client Ruby Library to version 2.3.10 or later. If upgrading is not possible immediately, implement input validation and restrict network access.
While no confirmed active exploitation campaigns are publicly known, SSRF vulnerabilities are frequently targeted, making proactive mitigation essential.
Refer to the Recurly security advisory for detailed information and updates: https://www.recurly.com/security/advisories/recurly-client-ssrf/
Lade deine Abhängigkeitsdatei hoch und erfahre sofort, ob dich diese und andere CVEs treffen.
Lade deine Gemfile.lock-Datei hoch und wir sagen dir sofort, ob du betroffen bist.