CVE-2017-0909: hackerone private_address_check ruby gem Incomplete List of Disallowed Inputs

Vulnerability summary

CVE-2017-0909 is a critical (CVSS 9.8) Incomplete List of Disallowed Inputs vulnerability in hackerone private_address_check ruby gem. EPSS estimates a 2.03% chance of exploitation in the next 30 days, higher than 80.7% of scored vulnerabilities.

Timeline

1. 16-11-2017
   PublishedVulnerability first disclosed.
2. 16-09-2024
   Last modifiedVulnerability information updated.

Description

The private_address_check ruby gem before 0.4.1 is vulnerable to a bypass due to an incomplete blacklist of common private/local network addresses used to prevent server-side request forgery.

• CWE-184Incomplete List of Disallowed InputsThe product implements a protection mechanism that relies on a list of inputs (or properties of inputs) that are not allowed by policy or otherwise require other action to neutralize before additional processing takes place, but the list is incomplete.