PT-2017-10705 · Recurly · Recurly Client Ruby Library

Publicado 2017-11-13 · Atualizado 2019-10-09 · CVE-2017-0905

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Recurly Client Ruby Library versions prior to 2.0.13 Recurly Client Ruby Library versions prior to 2.1.11 Recurly Client Ruby Library versions prior to 2.2.5 Recurly Client Ruby Library versions prior to 2.3.10 Recurly Client Ruby Library versions prior to 2.4.11 Recurly Client Ruby Library versions prior to 2.5.4 Recurly Client Ruby Library versions prior to 2.6.3 Recurly Client Ruby Library versions prior to 2.7.8 Recurly Client Ruby Library versions prior to 2.8.2 Recurly Client Ruby Library versions prior to 2.9.2 Recurly Client Ruby Library versions prior to 2.10.4 Recurly Client Ruby Library versions prior to 2.11.3

Description The issue is related to a Server-Side Request Forgery vulnerability in the Resource#find method. This could result in the compromise of API keys or other critical resources.

Recommendations For versions prior to 2.0.13, update to version 2.0.13 or later. For versions prior to 2.1.11, update to version 2.1.11 or later. For versions prior to 2.2.5, update to version 2.2.5 or later. For versions prior to 2.3.10, update to version 2.3.10 or later. For versions prior to 2.4.11, update to version 2.4.11 or later. For versions prior to 2.5.4, update to version 2.5.4 or later. For versions prior to 2.6.3, update to version 2.6.3 or later. For versions prior to 2.7.8, update to version 2.7.8 or later. For versions prior to 2.8.2, update to version 2.8.2 or later. For versions prior to 2.9.2, update to version 2.9.2 or later. For versions prior to 2.10.4, update to version 2.10.4 or later. For versions prior to 2.11.3, update to version 2.11.3 or later.

Exploit

Correção

SSRF

Enumeração de Fraquezas

CWE-918

Identificadores relacionados

CVE-2017-0905

GHSA-X27V-X225-GQ8G

Produtos afetados

Recurly Client Ruby Library

Referências · 9

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.yml · Exploit
• https://github.com/recurly/recurly-client-ruby · Nota
• https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be · Correção
• https://nvd.nist.gov/vuln/detail/CVE-2017-0905 · Nota de Segurança
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0905 · Nota
• https://osv.dev/vulnerability/GHSA-x27v-x225-gq8g · Aviso do Fabricante
• https://hackerone.com/reports/288635 · Nota
• https://dev.recurly.com/page/ruby-updates · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-0905 · Aviso do Fabricante