GHSA-3v3c-r5v2-68ph

ghsaUSosv

private_address_check contains Incomplete List of Disallowed Inputs

view advisory published 2017-11-30Licence: CC-BY-4.0

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

describes (1)

Related CVEs.

ID	severity	EPSS	exploitable	published
CVE-2017-0909US	critical9.8	2.03% (81st)	—	2017-11-16
The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side reque…

references

External citations — patches, advisories, analysis.

https://github.com/advisories/GHSA-3v3c-r5v2-68phADVISORY
https://github.com/jtdowney/private_address_checkPACKAGE
https://github.com/jtdowney/private_address_check/pull/3WEB
https://hackerone.com/reports/288950WEB
https://nvd.nist.gov/vuln/detail/CVE-2017-0909ADVISORY

scry

Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.

Free scan