Critical severity9.8NVD Advisory· Published Nov 13, 2017· Updated May 13, 2026

CVE-2017-0905

Description

The Recurly Client Ruby Library before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource#find" method that could result in compromise of API keys or other critical resources.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
recurlyRubyGems	>= 2.3.0, < 2.3.10	2.3.10
recurlyRubyGems	>= 2.2.0, < 2.2.5	2.2.5
recurlyRubyGems	>= 2.1.0, < 2.1.11	2.1.11
recurlyRubyGems	>= 2.0.0, < 2.0.13	2.0.13
recurlyRubyGems	>= 2.9.0, < 2.9.2	2.9.2
recurlyRubyGems	>= 2.8.0, < 2.8.2	2.8.2
recurlyRubyGems	>= 2.7.0, < 2.7.8	2.7.8
recurlyRubyGems	>= 2.6.0, < 2.6.3	2.6.3
recurlyRubyGems	>= 2.5.0, < 2.5.4	2.5.4
recurlyRubyGems	>= 2.4.0, < 2.4.11	2.4.11
recurlyRubyGems	>= 2.11.0, < 2.11.3	2.11.3
recurlyRubyGems	>= 2.10.0, < 2.10.4	2.10.4

Affected products

Recurly/Recurly Ruby Gemv5
Range: Versions before 2.0.13, 2.1.11, 2.2.5, 2.3.10, 2.4.11, 2.5.4, 2.6.3, 2.7.8, 2.8.2, 2.9.2, 2.10.4, 2.11.3
Recurly/Recurly Client Ruby80 versions
cpe:2.3:a:recurly:recurly_client_ruby:2.0.0:*:*:*:*:*:*:*+ 79 more
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.11:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.12:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.0:c:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.5:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.6:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.7:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.8:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.9:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.1.10:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.2.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.2.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.2.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.2.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.2.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.5:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.6:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.7:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.8:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.3.9:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.7:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.5:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.6:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.7:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc1:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.5:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.6:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.7:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.8:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.9:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.0.10:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.4:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.5:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.6:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.9:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.4.10:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.5.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.5.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.5.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.5.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.6.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.6.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.6.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.7.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.8.0:rc3:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.8.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.9.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.9.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.10.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.10.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.10.2:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.10.3:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.11.0:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.11.1:*:*:*:*:*:*:*
- cpe:2.3:a:recurly:recurly_client_ruby:2.11.2:*:*:*:*:*:*:*

Patches

1bb0284d6e66

Fix SSRF vulnerability in Resource#find

https://github.com/recurly/recurly-client-rubyBenjamin EckelNov 8, 2017via ghsa

commit

3 files changed · +10 −2

lib/recurly/api/net_http_adapter.rb+1 −0 modified

@@ -43,6 +43,7 @@ def request method, uri, options = {}
             }
             uri += "?#{pairs.join '&'}"
           end
+          self.validate_uri!(uri)
           request = METHODS[method].new uri.request_uri, head
           request.basic_auth(*[Recurly.api_key, nil].flatten[0, 2])
           if options[:body]

lib/recurly/api.rb+8 −0 modified

@@ -15,6 +15,7 @@ class API
     require 'recurly/api/errors'
 
     @@base_uri = "https://api.recurly.com/v2/"
+    @@valid_domains = [".recurly.com"]
 
     RECURLY_API_VERSION = '2.8'
 
@@ -75,6 +76,13 @@ def base_uri
         URI.parse @@base_uri.sub('api', Recurly.subdomain)
       end
 
+      def validate_uri!(uri)
+        domain = @@valid_domains.detect { |d| uri.host.end_with?(d) }
+        unless domain
+          raise ArgumentError, "URI #{uri} is invalid. You may only make requests to a Recurly domain."
+        end
+      end
+
       # @return [String]
       def user_agent
         "Recurly/#{Version}; #{RUBY_DESCRIPTION}"

lib/recurly/resource.rb+1 −2 modified

@@ -335,9 +335,8 @@ def find(uuid, options = {})
           raise NotFound, "can't find a record with nil identifier"
         end
 
-        uri = uuid =~ /^http/ ? uuid : member_path(uuid)
         begin
-          from_response API.get(uri, {}, options)
+          from_response API.get(member_path(uuid), {}, options)
         rescue API::NotFound => e
           raise NotFound, e.description
         end

Vulnerability mechanics

Generated by null/stub on May 9, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

github.com/recurly/recurly-client-ruby/commit/1bb0284d6e668b8b3d31167790ed6db1f6ccc4benvdPatchThird Party AdvisoryWEB
dev.recurly.com/page/ruby-updatesnvdVendor Advisory
github.com/advisories/GHSA-x27v-x225-gq8gghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2017-0905ghsaADVISORY
github.com/rubysec/ruby-advisory-db/blob/master/gems/recurly/CVE-2017-0905.ymlghsaWEB
hackerone.com/reports/288635nvdPermissions RequiredWEB

News mentions

No linked articles in our index yet.

cvss	0.637
epss	0.000
exploit	0.000
kev	0.000
patch	-0.070
ransomware	0.000