CVE-2021-22942

Vulnerability

CVE-2021-22942 is an open redirect vulnerability in the Host Authorization middleware of Action Pack (Ruby on Rails). Affected versions are Rails 6.0.0 through 6.0.4.1, 6.1.0 through 6.1.4.1, and 7.0.0.rc1. The middleware fails to properly validate specially crafted X-Forwarded-Host headers when the application's config.hosts includes entries with a leading dot (e.g., '.EXAMPLE.com'). This allows bypassing host authorization checks [1][2][3].

Exploitation

An attacker must be able to send HTTP requests to the Rails application and inject a malicious X-Forwarded-Host header. The application must have configured config.hosts with a leading dot (e.g., config.hosts << '.example.com'). When a request with a crafted X-Forwarded-Host header (e.g., evil.com) reaches the middleware, the malicious host is allowed because the leading dot pattern is misparsed, causing a redirect to the attacker-controlled domain [3].

Impact

Successful exploitation leads to an open redirect. An attacker can redirect users to a malicious website, enabling phishing attacks or credential theft. The vulnerability does not directly lead to code execution or data disclosure, but it can be used as a stepping stone for social engineering attacks [1][2]. The redirect occurs at the application level, appearing to come from a trusted Rails application.

Mitigation

Rails has released fixed versions: 6.0.4.2, 6.1.4.2, and 7.0.0.rc2 [3]. Users should upgrade immediately. As a workaround, avoid using leading dots in config.hosts entries. No public KEV listing exists for this CVE at this time [2]. If upgrade is not possible, applications can implement custom host validation to reject unexpected redirects.