Moderate severityNVD Advisory· Published Feb 11, 2021· Updated Aug 3, 2024
CVE-2021-22881
CVE-2021-22881
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected packages
Versions sourced from the GitHub Security Advisory.
| Package | Affected versions | Patched versions |
|---|---|---|
actionpackRubyGems | >= 6.0.0, < 6.0.3.5 | 6.0.3.5 |
actionpackRubyGems | >= 6.1.0, < 6.1.2.1 | 6.1.2.1 |
Affected products
3- Action Pack/Action Packdescription
- ghsa-coords2 versions
>= 6.0.0, < 6.0.3.5+ 1 more
- (no CPE)range: >= 6.0.0, < 6.0.3.5
- (no CPE)range: < 6.0.4.4-1.1
Patches
Vulnerability mechanics
References
16- github.com/advisories/GHSA-8877-prq4-9xfwghsaADVISORY
- lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/mitrevendor-advisoryx_refsource_FEDORA
- nvd.nist.gov/vuln/detail/CVE-2021-22881ghsaADVISORY
- www.openwall.com/lists/oss-security/2021/05/05/2ghsamailing-listx_refsource_MLISTWEB
- www.openwall.com/lists/oss-security/2021/08/20/1ghsamailing-listx_refsource_MLISTWEB
- www.openwall.com/lists/oss-security/2021/12/14/5ghsamailing-listx_refsource_MLISTWEB
- benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorizationghsaWEB
- benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/mitrex_refsource_MISC
- discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130ghsax_refsource_MISCWEB
- github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.mdghsaWEB
- github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444ghsaWEB
- github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.ymlghsaWEB
- groups.google.com/g/rubyonrails-security/c/zN_3qA26l6EghsaWEB
- hackerone.com/reports/1047447ghsax_refsource_MISCWEB
- lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3ghsaWEB
- rubygems.org/gems/actionpackghsaWEB
News mentions
0No linked articles in our index yet.