The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers...
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2021-22881 rails Fixed in: 2:6.0.3.5+dfsg-1
- Ubuntu UBUNTU-CVE-2021-22881 rails
Original description The description as published by the source.
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory openwall.com
- advisory openwall.com
- patch openwall.com
- patch benjamin-bouchet.com
- patch discuss.rubyonrails.org
- patch hackerone.com
- web lists.fedoraproject.org