Lucene search

RubySecRUBY:PRIVATE_ADDRESS_CHECK-2017-0904

HistoryNov 06, 2017 - 9:00 p.m.

private_address_check Ruby Gem Resolv.getaddresses Server-Side Request Forgery

2017-11-0621:00:00

RubySec

github.com

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

JSON

The private_address_check ruby gem before 0.4.0 is vulnerable to a bypass due to use of Ruby’s
Resolv.getaddresses method, which is OS-dependent and should not be relied upon for security
measures, such as when used to blacklist private network addresses to prevent server-side
request forgery.

Affected configurations

Vulners

Node

rubyprivate_address_checkRange≤0.4.0

VendorProductVersionCPE
rubyprivate_address_check*cpe:2.3:a:ruby:private_address_check:*:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
ruby	private_address_check	*	cpe:2.3:a:ruby:private_address_check::::::::

References

github.com/jtdowney/private_address_check/issues/1

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

8.1

Attack Vector

NETWORK

Attack Complexity

HIGH

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

JSON

Related for RUBY:PRIVATE_ADDRESS_CHECK-2017-0904