Razorpay IFSC EUVD-2026-99007

Exploitation requires the consuming application to pass attacker-controlled input directly into IFSC.find or IFSC#get; the attacker supplies a network-path reference (e.g. //evil.host) or an absolute URI that Ruby's URI.join interprets as a new host, overriding the intended Razorpay API base. The core limiting factor is that the application must expose this lookup to untrusted input and return or act on the parsed response - the gem itself performs no authentication (PR:N) and needs no user interaction, but impact is confined to reading parsed response fields (low confidentiality), with no write or availability effect. Internal reachability of the target host from the server running the gem is also required for SSRF to reach sensitive endpoints.

This is a medium-severity SSRF (CWE-918) rated CVSS 4.0 base 6.9 with vector AV:N/AC:L/AT:N/PR:N/UI:N and VC:L (only low confidentiality impact; VI:N/VA:N). The signals are internally consistent: network-reachable, low complexity, no authentication or user interaction, but limited to reading parsed response fields rather than full code execution or data destruction. No EPSS score was provided in the input, so exploitation probability cannot be quantified. The vulnerability is NOT listed in CISA KEV and no public exploit code is confirmed in the provided data, though a HackMD write-up and a VulnCheck advisory are referenced and may contain technical detail - treat POC status as unconfirmed. SSVC-style read: exploitation status is unproven, technical impact is partial (confidentiality-only SSRF), and automatability is plausible but unconfirmed. Net: this is a real but moderate-priority issue - the 6.9 score is honest, not inflated, but the confidentiality-only impact and dependence on an application exposing the vulnerable lookup to untrusted input keep it below critical. Prioritize for Ruby/Rails fintech stacks that call this gem on user-supplied IFSC values; it is lower urgency for environments that do not.

An attacker interacts with a web application that passes user-supplied IFSC codes to IFSC.find or IFSC#get (e.g., a bank-account validation form). Instead of a valid IFSC, the attacker submits a network-path reference or absolute URI that URI.join resolves as a new host, coercing the gem into issuing a GET request to an internal metadata endpoint or attacker-chosen host and returning parsed response fields. No authentication or user interaction is required per the CVSS vector; no public exploit is confirmed in the provided data, though referenced advisories may detail the technique.