{"id":"GHSA-x27v-x225-gq8g","summary":"Recurly gem Server-Side Request Forgery in Resource#find method","details":"The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the `Resource#find` method that could result in compromise of API keys or other critical resources.","aliases":["CVE-2017-0905"],"modified":"2024-02-16T08:21:56.684023Z","published":"2017-12-06T16:43:00Z","database_specific":{"severity":"CRITICAL","github_reviewed":true,"github_reviewed_at":"2020-06-16T22:01:40Z","nvd_published_at":null,"cwe_ids":["CWE-918"]},"references":[{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0905"},{"type":"WEB","url":"https://github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4be"},{"type":"WEB","url":"https://hackerone.com/reports/288635"},{"type":"PACKAGE","url":"https://github.com/recurly/recurly-client-ruby"},{"type":"WEB","url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.yml"}],"affected":[{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.3.0"},{"fixed":"2.3.10"}]}],"versions":["2.3.0","2.3.1","2.3.2","2.3.3","2.3.4","2.3.5","2.3.6","2.3.7","2.3.8","2.3.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.2.0"},{"fixed":"2.2.5"}]}],"versions":["2.2.0","2.2.1","2.2.2","2.2.3","2.2.4"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.1.0"},{"fixed":"2.1.11"}]}],"versions":["2.1.0","2.1.1","2.1.10","2.1.2","2.1.3","2.1.4","2.1.5","2.1.7","2.1.8","2.1.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.0.0"},{"fixed":"2.0.13"}]}],"versions":["2.0.0","2.0.1","2.0.10","2.0.11","2.0.12","2.0.2","2.0.3","2.0.4","2.0.5","2.0.6","2.0.8","2.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.9.0"},{"fixed":"2.9.2"}]}],"versions":["2.9.0","2.9.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.8.0"},{"fixed":"2.8.2"}]}],"versions":["2.8.0","2.8.1"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.7.0"},{"fixed":"2.7.8"}]}],"versions":["2.7.0","2.7.1","2.7.2","2.7.3","2.7.4","2.7.5","2.7.6","2.7.7"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.6.0"},{"fixed":"2.6.3"}]}],"versions":["2.6.0","2.6.1","2.6.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.5.0"},{"fixed":"2.5.4"}]}],"versions":["2.5.0","2.5.1","2.5.2","2.5.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.4.0"},{"fixed":"2.4.11"}]}],"versions":["2.4.0","2.4.1","2.4.10","2.4.2","2.4.3","2.4.4","2.4.5","2.4.6","2.4.7","2.4.8","2.4.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.11.0"},{"fixed":"2.11.3"}]}],"versions":["2.11.0","2.11.1","2.11.2"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}},{"package":{"name":"recurly","ecosystem":"RubyGems","purl":"pkg:gem/recurly"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"2.10.0"},{"fixed":"2.10.4"}]}],"versions":["2.10.0","2.10.1","2.10.2","2.10.3"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/12/GHSA-x27v-x225-gq8g/GHSA-x27v-x225-gq8g.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"}]}