vulnwire
9.8crit

CVE-2017-0905

Recurly gem Server-Side Request Forgery in Resource#find method

Also known as GHSA-x27v-x225-gq8g

Published 8 y ago · modified 4 mo ago · JSON

CVSS
9.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
2.6%
percentile 85%
Public exploits
0
none known

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

Exploit prediction (EPSS)

2.59% probability of exploitation in the next 30 days, higher than 85% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P
GitHub3.09.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected packages

EcosystemPackageAffectedFixed in
rubygemsrecurly
>=2.3.0, <2.3.10
>=2.2.0, <2.2.5
>=2.1.0, <2.1.11
>=2.0.0, <2.0.13
>=2.9.0, <2.9.2
>=2.8.0, <2.8.2
>=2.7.0, <2.7.8
>=2.6.0, <2.6.3
>=2.5.0, <2.5.4
>=2.4.0, <2.4.11
>=2.11.0, <2.11.3
>=2.10.0, <2.10.4
2.3.10
2.2.5
2.1.11
2.0.13
2.9.2
2.8.2
2.7.8
2.6.3
2.5.4
2.4.11
2.11.3
2.10.4

Affected products

  • Recurly recurly ruby gem

Classification

Weakness
  • CWE-918 Server-Side Request Forgery

References

  • dev.recurly.com /page/ruby-updates · x_refsource_CONFIRM, x_transferred
  • hackerone.com /reports/288635 · x_refsource_MISC, x_transferred
  • github.com /recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be · x_refsource_CONFIRM, x_transferred
  • nvd.nist.gov /vuln/detail/CVE-2017-0905 · advisory
  • github.com /recurly/recurly-client-ruby · package
  • github.com /rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.yml · web

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.