CVE-2017-0906
Recurly Python Library SSRF API compromise risk
- CVSS 9.8
- CWE-918 Server-Side Request Forgery (SSRF)
- Configuration Issues
- Remote
The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API keys or other critical resources.
- CVSS base score
- 9.8
- Published
- 2017-11-13
- OWASP
- A10 Server Side Request Forgery (SSRF)
- Orthogonal defect classification
- Function
- Code defect classification
- Incorrect Functionality
- Category
- Configuration Issues
- Subcategory
- Server-Side Request Forgery (SSRF)
- Accessibility scope
- Remote
- Impact
- Unauthorized Access
- Fixed by upgrading
- Yes
Solution
Update Recurly Client Python Library to version 2.7.0 or higher.
Vulnerable code sample
import requests
class RecurlyClient:
def get_resource(self, resource_url):
response = requests.get(resource_url)
return response.json()
client = RecurlyClient()
resource = client.get_resource("http://localhost:8080/api/resource")
print(resource)Patched code sample
import requests
from urllib.parse import urlparse
class RecurlyClient:
def get_resource(self, resource_url):
parsed_url = urlparse(resource_url)
if parsed_url.scheme not in ['http', 'https']:
raise ValueError("Invalid URL scheme. Only 'http' and 'https' are allowed.")
if parsed_url.hostname in ['localhost', '127.0.0.1'] or \
parsed_url.hostname.startswith('10.') or \
parsed_url.hostname.startswith('192.168.') or \
parsed_url.hostname.startswith('172.') and 16 <= int(parsed_url.hostname.split('.')[1]) <= 31:
raise ValueError("Access to private IP addresses is not allowed.")
response = requests.get(resource_url)
return response.json()
client = RecurlyClient()
try:
resource = client.get_resource("https://example.com/api/resource")
print(resource)
except ValueError as e:
print(f"Error: {e}")Cite this entry
@misc{vaitp:cve20170906,
title = {{Recurly Python Library SSRF API compromise risk}},
author = {Bogaerts, Fr\'ed\'eric and Ivaki, Naghmeh and Fonseca, Jos\'e},
year = {2017},
note = {VAITP Python Vulnerability Dataset, entry CVE-2017-0906},
howpublished = {\url{https://netpack.pt/vaitp/vulnerability/CVE-2017-0906/}}
}Introducing the "VAITP dataset": a specialized repository of Python vulnerabilities and patches, meticulously compiled for the use of the security research community. As Python's prominence grows, understanding and addressing potential security vulnerabilities become crucial. Crafted by and for the cybersecurity community, this dataset offers a valuable resource for researchers, analysts, and developers to analyze and mitigate the security risks associated with Python. Through the comprehensive exploration of vulnerabilities and corresponding patches, the VAITP dataset fosters a safer and more resilient Python ecosystem, encouraging collaborative advancements in programming security.
The supreme art of war is to subdue the enemy without fighting.
Sun Tzu – “The Art of War”
:: Shaping the future through research and ingenuity ::