CVE-2021-22881
published 2021-02-11CVE-2021-22881: The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in…
PriorityP264medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EXPLOIT
EPSS
87.30%
99.7th percentile
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Affected
19 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 6.0.0 < 6.0.4.2 | 6.0.4.2 |
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.5 | 6.0.3.5 |
| actionpack_project | actionpack | >= 6.0.0 < 6.0.4.1 | 6.0.4.1 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.4.2 | 6.1.4.2 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.2.1 | 6.1.2.1 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.4.1 | 6.1.4.1 |
| actionpack_project | actionpack | >= 6.1.0.rc2 < 6.1.3.2 | 6.1.3.2 |
| debian | rails | < rails 2:6.0.3.5+dfsg-1 (bookworm) | rails 2:6.0.3.5+dfsg-1 (bookworm) |
| debian | rails | — | — |
| fedoraproject | fedora | — | — |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.5+dfsg-1 | 2:6.0.3.5+dfsg-1 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.5 | 6.0.3.5 |
| rubyonrails | rails | >= 6.1.0 < 6.1.2.1 | 6.1.2.1 |
| rubyonrails | rails | >= 6.1.1 < 6.1.3.2 | 6.1.3.2 |
Detection & IOCsextracted from sources · hover to see the quote
otherGET / HTTP/1.1
Host: interact.sh#{{randstr}}.{{Hostname}}
regex(?m)^(?:Location\s*?:\s*?)(?:https?://|//)?(?:[a-zA-Z0-9\-_\.@]*)interact\.sh.*$
- →Look for HTTP 301/302 redirect responses where the Location header points to an external domain not matching the application's configured allowed hosts — indicative of Host header injection exploitation.
- →Monitor for crafted Host headers containing a fragment identifier (#) followed by a domain, used to bypass Host Authorization middleware with leading-dot allowed host configurations. ↗
- →Inspect X-Forwarded-Host header values for mixed-case or uppercase domain names that may bypass the missing `.downcase` normalization in host_authorization.rb, allowing unauthorized hosts to pass the `forwarded_host.nil?` check. ↗
- →Flag inbound requests where the X-Forwarded-Host header contains a value that differs in case from the Host header, particularly when the application has allowed hosts configured with leading dots (e.g., `.EXAMPLE.com`). ↗
- →Alert on the vulnerable code path in actionpack/lib/action_dispatch/middleware/host_authorization.rb at line 115 where forwarded_host regex match is performed without downcasing the X-Forwarded-Host value. ↗
- ·Only applications with allowed hosts containing a leading dot in their config.hosts are impacted by CVE-2021-22881. ↗
- ·Red Hat Satellite is not affected because it does not use the config.hosts setting. ↗
- ·The X-Forwarded-Host bypass variant (CVE-2021-22942) affects Rails <= 6.1.3.1 and requires the application to have uppercase or mixed-case entries in config.hosts (e.g., 'Evil.com'). ↗
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_debian6.1LOW
vendor_redhat6.1MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
actionpack Open Redirect in Host Authorization Middleware
osv·2021-12-14·CVSS 6.1
CVE-2021-44528 [MEDIUM] actionpack Open Redirect in Host Authorization Middleware
actionpack Open Redirect in Host Authorization Middleware
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release seri
GHSA
actionpack Open Redirect in Host Authorization Middleware
ghsa·2021-12-14·CVSS 6.1
CVE-2021-44528 [MEDIUM] CWE-601 actionpack Open Redirect in Host Authorization Middleware
actionpack Open Redirect in Host Authorization Middleware
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release seri
OSV
Open Redirect in ActionPack
osv·2021-08-26·CVSS 6.1
CVE-2021-22942 [MEDIUM] Open Redirect in ActionPack
Open Redirect in ActionPack
# Overview
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1
# Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```ruby
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
T
GHSA
Open Redirect in ActionPack
ghsa·2021-08-26·CVSS 6.1
CVE-2021-22942 [MEDIUM] CWE-601 Open Redirect in ActionPack
Open Redirect in ActionPack
# Overview
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1
# Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```ruby
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
T
OSV
CVE-2021-22903: The actionpack ruby gem before 6
osv·2021-06-11·CVSS 6.1
CVE-2021-22903 [MEDIUM] CVE-2021-22903: The actionpack ruby gem before 6
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
OSV
Possible Open Redirect Vulnerability in Action Pack
osv·2021-05-05·CVSS 6.1
CVE-2021-22903 [MEDIUM] Possible Open Redirect Vulnerability in Action Pack
Possible Open Redirect Vulnerability in Action Pack
There is a possible Open Redirect Vulnerability in Action Pack.
Versions Affected: >= v6.1.0.rc2
Not affected: < v6.1.0.rc2
Fixed Versions: 6.1.3.2
Impact
This is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious
website.
Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey
GHSA
Possible Open Redirect Vulnerability in Action Pack
ghsa·2021-05-05·CVSS 6.1
CVE-2021-22903 [MEDIUM] CWE-601 Possible Open Redirect Vulnerability in Action Pack
Possible Open Redirect Vulnerability in Action Pack
There is a possible Open Redirect Vulnerability in Action Pack.
Versions Affected: >= v6.1.0.rc2
Not affected: < v6.1.0.rc2
Fixed Versions: 6.1.3.2
Impact
This is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious
website.
Since rails/rails@9bc7ea5, strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey
OSV
Actionpack Open Redirect Vulnerability
osv·2021-03-02
CVE-2021-22881 [MEDIUM] Actionpack Open Redirect Vulnerability
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
GHSA
Actionpack Open Redirect Vulnerability
ghsa·2021-03-02
CVE-2021-22881 [MEDIUM] CWE-601 Actionpack Open Redirect Vulnerability
Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
OSV
CVE-2021-22881: The Host Authorization middleware in Action Pack before 6
osv·2021-02-11·CVSS 6.1
CVE-2021-22881 [MEDIUM] CVE-2021-22881: The Host Authorization middleware in Action Pack before 6
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Red Hat
rubygem-actionpack: Possible Open Redirect Vulnerability in Action Pack
vendor_redhat·2021-05-05·CVSS 6.1
CVE-2021-22903 [MEDIUM] CWE-601 rubygem-actionpack: Possible Open Redirect Vulnerability in Action Pack
rubygem-actionpack: Possible Open Redirect Vulnerability in Action Pack
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
A flaw was found in rubygem-actionpack. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in A
Red Hat
rubygem-actionpack: open redirect vulnerability may lead to confidentiality and integrity compromise
vendor_redhat·2021-02-11·CVSS 6.1
CVE-2021-22881 [MEDIUM] CWE-601 rubygem-actionpack: open redirect vulnerability may lead to confidentiality and integrity compromise
rubygem-actionpack: open redirect vulnerability may lead to confidentiality and integrity compromise
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
The Host Authorization middleware in Action Pack suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Auth
Debian
CVE-2021-22881: rails - The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers...
vendor_debian·2021·CVSS 6.1
CVE-2021-22881 [MEDIUM] CVE-2021-22881: rails - The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers...
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Scope: local
bookworm: resolved (fixed in 2:6.0.3.5+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.5+dfsg-1)
forky: resolved (fixed in 2:6.0.3.5+dfsg-1)
sid: resolved (fixed in 2:6.0.3.5+dfsg-1)
trixie: resolved (fixed in 2:6.0.3.5+dfsg-1)
Debian
CVE-2021-22903: rails - The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vul...
vendor_debian·2021·CVSS 6.1
CVE-2021-22903 [MEDIUM] CVE-2021-22903: rails - The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vul...
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
Scope: local
bookworm: resolved
bullseye: resolved
forky: resolved
sid: resolved
trixie: resolved
No detection rules found.
Nuclei
Ruby on Rails - Open Redirect via Host Header Injection
nuclei·CVSS 6.1
CVE-2021-22881 [MEDIUM] Ruby on Rails - Open Redirect via Host Header Injection
Ruby on Rails - Open Redirect via Host Header Injection
Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers.
Template:
id: CVE-2021-22881
info:
name: Ruby on Rails - Open Redirect via Host Header Injection
author: theamanrawat
severity: medium
description: |
Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers.
impact: |
Attackers can redirect users to malicious sites, pot
http://www.openwall.com/lists/oss-security/2021/05/05/2http://www.openwall.com/lists/oss-security/2021/08/20/1http://www.openwall.com/lists/oss-security/2021/12/14/5https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130https://hackerone.com/reports/1047447https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/http://www.openwall.com/lists/oss-security/2021/05/05/2http://www.openwall.com/lists/oss-security/2021/08/20/1http://www.openwall.com/lists/oss-security/2021/12/14/5https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130https://hackerone.com/reports/1047447https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/
2021-02-11
Published