CVE-2021-22881

NameCVE-2021-22881
DescriptionThe Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severitymedium

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)stretch2:4.2.7.1-1+deb9u2fixed
stretch (security)2:4.2.7.1-1+deb9u5fixed
buster, buster (security)2:5.2.2.1+dfsg-1+deb10u3fixed
bullseye, sid2:6.0.3.7+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssourcestretch(not affected)
railssourcebuster(not affected)
railssource(unstable)2:6.0.3.5+dfsg-1

Notes

[buster] - rails <not-affected> (Vulnerable code not present)
[stretch] - rails <not-affected> (host_authorization.rb added later)
https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130
https://hackerone.com/reports/1047447
https://github.com/rails/rails/commit/83a6ac3fee8fd538ce7e0088913ff54f0f9bcb6f (main)
https://github.com/rails/rails/commit/e33092740b3cc05f5abee197a5982eac31947e92 (v6.0.3.5)

Search for package or bug name: Reporting problems