Executive brief
Recurly's Python client library, which is used by applications to communicate with Recurly's billing and subscription service, contains a server-side request forgery vulnerability in the Resource.get method. An attacker could exploit this to make the Recurly client send requests to arbitrary servers, potentially compromising API keys and other critical credentials used to manage customer billing.
Technical details
The Recurly Python client library versions before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, and 2.6.2 are vulnerable to a server-side request forgery (SSRF) vulnerability in the Resource.get method. The root cause is improper URL construction using urljoin without proper quoting of UUIDs, allowing an attacker to craft malicious input that constructs arbitrary URLs. The vulnerability is remotely exploitable without authentication and requires only the ability to influence resource identifiers passed to the get method. An attacker can exploit this to make the client perform HTTP requests to internal or external systems, potentially exposing API keys and other sensitive data. Patches are available in the specified fixed versions.
Affected products
- Recurly Python Client before 2.0.5, 2.1.16, 2.2.22, 2.3.1, 2.4.5, 2.5.1, 2.6.2
Timeline
- 2019-01-04: disclosed
- other: Patch commit 049c746 available on GitHub