Vulnerability · Published Feb 11, 2021 · Assigned by hackerone
CVE-2021-22881
Medium 6.1
In plain English
A medium-severity open redirect in https://github.com/rails/rails. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 87.3% (higher than 99.8% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.
Official description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | rails | 2:6.0.3.5+dfsg-1 | DEBIAN-CVE-2021-22881 |
| Debian:13 | rails | 2:6.0.3.5+dfsg-1 | DEBIAN-CVE-2021-22881 |
| Debian:14 | rails | 2:6.0.3.5+dfsg-1 | DEBIAN-CVE-2021-22881 |
| RubyGems | actionpack | 6.0.3.5 | GHSA-8877-prq4-9xfw |
| RubyGems | actionpack | 6.1.2.1 | GHSA-8877-prq4-9xfw |
| Ubuntu:24.04:LTS | rails | no fix listed | UBUNTU-CVE-2021-22881 |
| Ubuntu:25.10 | rails | no fix listed | UBUNTU-CVE-2021-22881 |
| Ubuntu:26.04:LTS | rails | no fix listed | UBUNTU-CVE-2021-22881 |
| Ubuntu:26.10 | rails | no fix listed | UBUNTU-CVE-2021-22881 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| n/a | https://github.com/rails/rails | Fixed in 6.1.2.1, 6.0.3.5 |
Weakness: CWE-601
References
- https://hackerone.com/reports/1047447 x_refsource_MISC
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 x_refsource_MISC
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/ x_refsource_MISC
- FEDORA-2021-b571fca1b8 vendor-advisory, x_refsource_FEDORA
- [oss-security] 20210505 [CVE-2021-22903] Possible Open Redirect Vulnerability in Action Pack mailing-list, x_refsource_MLIST
- [oss-security] 20210819 [CVE-2021-22942] Possible Open Redirect in Host Authorization Middleware mailing-list, x_refsource_MLIST
- [oss-security] 20211214 [CVE-2021-44528] Possible Open Redirect in Host Authorization Middleware mailing-list, x_refsource_MLIST