CVE-2017-0906: Server-Side Request Forgery in recurly

recurly Updated 02 Oct 2025

Summary

13/11/2017

Disclosed on

CVE-2017-0906

CVE

Yes i

Fix available

Critical

Severity

9.8

CVSS Score

CVE-2017-0906: The Recurly Client Python Library before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2 is vulnerable to a Server-Side Request Forgery vulnerability in the "Resource.get" method that could result in compromise of API... Affects recurly across 8 version ranges.

>= 2.0, < 2.0.5 >= 2.1, < 2.1.16 >= 2.2, < 2.2.22 >= 2.3, < 2.3.1 >= 2.4, < 2.4.5 >= 2.5, < 2.5.1 >= 2.6, < 2.6.2 < 049c74699ce93cf126feff06d632ea63fba36742

Fixed in 7 releases; the minimum fixed version depends on the release line you run. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

Recurly is a client Python library that provides functionality for integrating with the Recurly API. It allows developers to manage subscription billing and recurring payments. The library is widely used in Python projects that require subscription management and payment processing. However, versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, and 2.6.2 of the Recurly Client Python Library are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability in the "Resource.get" method.

Vulnerability Detail

The SSRF vulnerability in the Recurly Client Python Library allows an attacker to forge requests from the server to arbitrary destinations. This can lead to the compromise of API keys or other critical resources. By exploiting this vulnerability, an attacker could potentially gain unauthorized access to sensitive information or perform actions on behalf of the server. The vulnerability originates from inadequate input validation and sanitization in the "Resource.get" method.

How To Fix

Fixed versions by release line

The minimum fixed version depends on the release line you run.

>= 2.0, < 2.0.5 2.0.5
```
pip install --upgrade "recurly==2.0.5"
```
>= 2.1, < 2.1.16 2.1.16
```
pip install --upgrade "recurly==2.1.16"
```
>= 2.2, < 2.2.22 2.2.22
```
pip install --upgrade "recurly==2.2.22"
```
>= 2.3, < 2.3.1 2.3.1
```
pip install --upgrade "recurly==2.3.1"
```
>= 2.4, < 2.4.5 2.4.5
```
pip install --upgrade "recurly==2.4.5"
```
>= 2.5, < 2.5.1 2.5.1
```
pip install --upgrade "recurly==2.5.1"
```

Show all 7 release lines

>= 2.6, < 2.6.2 2.6.2
```
pip install --upgrade "recurly==2.6.2"
```

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

There is no specific workaround provided for this vulnerability. However, as a general best practice, developers should implement strict input validation and sanitization to prevent SSRF attacks. It is also recommended to implement proper access controls and restrict the server's ability to make requests to external resources.

Conclusion

The Recurly Client Python Library versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, and 2.6.2 are vulnerable to a Server-Side Request Forgery (SSRF) vulnerability. This vulnerability can result in the compromise of API keys or other critical resources. To mitigate the risk, it is recommended to upgrade to one of the fixed versions and implement strict input validation and sanitization. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for recurly →

FAQ

What is a Server-Side Request Forgery (SSRF) vulnerability?

A Server-Side Request Forgery (SSRF) vulnerability is a type of security vulnerability that allows an attacker to make requests from the server to arbitrary destinations. This can lead to unauthorized access to internal resources, compromise of sensitive information, or perform actions on behalf of the server.

What are the potential ramifications of this vulnerability?

The potential ramifications of this vulnerability include the compromise of API keys or other critical resources. An attacker could gain unauthorized access to sensitive information or perform actions on behalf of the server, leading to data breaches, unauthorized transactions, or other malicious activities.

How can I check if my application is affected by this vulnerability?

You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities, using just Pipfile.lock to provide accurate vulnerability information without requiring access to the code or installation.

Are there any known instances of this vulnerability being exploited?

There are no known instances of this vulnerability being exploited in the wild. However, it is crucial to address this vulnerability promptly to prevent potential security breaches or unauthorized access to sensitive resources.