Medium severity6.1NVD Advisory· Published Feb 11, 2021· Updated Jun 17, 2026
CVE-2021-22881
CVE-2021-22881
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
actionpackRubyGems | >= 6.0.0, < 6.0.3.5 | 6.0.3.5 |
actionpackRubyGems | >= 6.1.0, < 6.1.2.1 | 6.1.2.1 |
Affected products
5- cpe:2.3:o:fedoraproject:fedora:33:*:*:*:*:*:*:*
- Action Pack/Action Packdescription
- ghsa-coords2 versions
>= 6.0.0, < 6.0.3.5+ 1 more
- (no CPE)range: >= 6.0.0, < 6.0.3.5
- (no CPE)range: < 6.0.4.4-1.1
Patches
Vulnerability mechanics
References
16- benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/nvdPatchThird Party Advisory
- discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130nvdMitigationPatchVendor AdvisoryWEB
- www.openwall.com/lists/oss-security/2021/12/14/5nvdExploitMailing ListPatchWEB
- hackerone.com/reports/1047447nvdExploitPatchThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2021/05/05/2nvdMailing ListMitigationThird Party AdvisoryWEB
- www.openwall.com/lists/oss-security/2021/08/20/1nvdMailing ListMitigationThird Party AdvisoryWEB
- github.com/advisories/GHSA-8877-prq4-9xfwghsaADVISORY
- nvd.nist.gov/vuln/detail/CVE-2021-22881ghsaADVISORY
- benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorizationghsaWEB
- github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.mdghsaWEB
- github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.ymlghsaWEB
- groups.google.com/g/rubyonrails-security/c/zN_3qA26l6EghsaWEB
- lists.fedoraproject.org/archives/list/[email protected]/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3ghsaWEB
- rubygems.org/gems/actionpackghsaWEB
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/nvd
News mentions
0No linked articles in our index yet.