CVE-2026-110222

Awaiting Analysis Awaiting Analysis - Queue

Server-Side Request Forgery in Razorpay IFSC Ruby Gem

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: VulnCheck

Description

Razorpay IFSC Ruby gem through 2.0.62 contains a server-side request forgery vulnerability that allows attackers to redirect API requests by supplying a crafted IFSC code to IFSC.find or IFSC#get. Attackers can submit network-path references or absolute URIs that URI.join resolves as a new host, sending GET requests to internal or attacker-chosen hosts and returning parsed response fields.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-110222

EUVD

EUVD-2026-99007

Affected Vendors & Products

Vendor	Product	Version / Range
Razorpay	IFSC	0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-918	The web server receives a URL or similar request from an upstream component and retrieves the contents of this URL, but it does not sufficiently ensure that the request is being sent to the expected destination.

Attack-Flow Graph

Executive Summary

This is a Server-Side Request Forgery (SSRF) vulnerability in the Razorpay IFSC Ruby gem up to version 2.0.62. Attackers can craft malicious IFSC codes that, when processed by the library's IFSC.find or IFSC#get methods, redirect API requests to unintended hosts. The issue occurs because the library uses URI.join to construct URLs without validating input, allowing network-path references or absolute URIs to override the intended API host (ifsc.razorpay.com). This enables attackers to send GET requests to internal systems or external hosts of their choice and retrieve parsed response fields.

Detection Guidance

Check if your application uses the Razorpay IFSC Ruby gem version 2.0.62 or earlier. Inspect network logs for unusual outbound requests to internal or external hosts triggered by IFSC code lookups. Test with crafted IFSC inputs like //127.0.0.1:8080/internal to see if requests are redirected.

Impact Analysis

An attacker could exploit this to access internal services, perform network reconnaissance, or disclose sensitive data. If your application uses the vulnerable gem and forwards user-controlled IFSC input directly to IFSC.find or IFSC#get, attackers may send requests to internal hosts, bypassing firewalls or accessing restricted systems. This could lead to data breaches, unauthorized information retrieval, or further network compromise depending on the internal services exposed.

Compliance Impact

This SSRF vulnerability could lead to unauthorized access to sensitive data, violating GDPR's data protection principles (e.g., integrity and confidentiality) and HIPAA's security requirements for protected health information. If exploited, it may result in data breaches, triggering mandatory breach notifications under GDPR (Article 33) and potential HIPAA violations, leading to fines or legal penalties. Compliance programs relying on secure data handling could be compromised.

Mitigation Strategies

Upgrade the Razorpay IFSC Ruby gem to a patched version that validates IFSC input strictly before network requests. Ensure the gem does not accept network-path references or absolute URIs in IFSC codes. Implement input validation and set HTTP request timeouts.

Hi! I’m here to help you understand CVE-2026-110222. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70