CVE-2021-22904

Vulnerability

The actionpack Ruby gem before versions 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 contains a denial of service vulnerability in the Token Authentication logic of Action Controller. The issue stems from a too permissive regular expression used to parse HTTP Authorization headers when the application uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication. All versions starting from 4.0.0 are affected [1][4].

Exploitation

An attacker can exploit this vulnerability by sending a specially crafted HTTP request with a malformed Authorization header containing a token that triggers catastrophic backtracking in the regular expression. No authentication is required, and the attacker only needs network access to the target application. The malicious header causes the regex engine to consume excessive CPU time, leading to a denial of service [4].

Impact

Successful exploitation results in a denial of service condition, where the affected server becomes unresponsive or significantly degraded due to high CPU usage. This can impact availability for legitimate users. The vulnerability does not lead to information disclosure, privilege escalation, or remote code execution [1][4].

Mitigation

Users should upgrade to the fixed versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, or 5.2.6. For those unable to upgrade immediately, a monkey patch workaround is available: add module ActionController::HttpAuthentication::Token; AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/; end to an initializer. Patches for the supported release series (5.2, 6.0, 6.1) are provided in the official advisory [4]. Users of unsupported releases (before 4.0.0 or between 4.0.0 and 5.2) are advised to upgrade as soon as possible [4].