CVE-2021-22903

2021-06-1115:49:38

CWE-601

hackerone

www.cve.org

actionpack

open redirect

vulnerability

host headers

allowed host

middleware

AI Score

6.4

Confidence

High

EPSS

0.002

Percentile

61.0%

JSON

The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.

CNA Affected

[
  {
    "product": "https://github.com/rails/rails",
    "vendor": "n/a",
    "versions": [
      {
        "status": "affected",
        "version": "Fixed in 6.1.3.2"
      }
    ]
  }
]