CVE-2023-22797

What the vulnerability is

CVE-2023-22797 is an open redirect vulnerability in the Ruby on Rails framework, specifically in Action Pack. It arises from an insufficient check added to protect against open redirects when calling redirect_to with untrusted user input. Rails 7.0.4.1 introduced a new protection mechanism, but the implementation of the _url_host_allowed? method could be bypassed by a carefully crafted URL, allowing an attacker to redirect users to external malicious sites [1][4].

How it is exploited

The vulnerability can be exploited by an attacker who controls the redirect_to parameter in a Rails application. By crafting a URL that passes the _url_host_allowed? check but ultimately points to an untrusted host, an attacker can trick the application into performing an open redirect. This attack requires that the application uses redirect_to with user-supplied input, which is a common pattern for features like login redirects [3][4]. No special privileges are needed beyond the ability to craft HTTP requests to the vulnerable endpoint.

Impact

Successful exploitation allows an attacker to redirect users from a legitimate Rails application to a malicious website. This can be used for phishing attacks, credential theft, or to distribute malware. The open redirect can undermine user trust and lead to security breaches, as users may believe they are navigating within a trusted domain when they are actually being sent to an attacker-controlled site [1][3].

Mitigation

The vulnerability is fixed in Rails version 7.0.4.1. Users are strongly advised to upgrade their Rails applications to this or a later patched version. There is no workaround other than updating, as the previous protections were found to be bypassable [4]. The advisory recommends that developers ensure they are not using user-supplied input directly in redirect_to without proper validation [3].