CVE-2021-22904
published 2021-06-11CVE-2021-22904: The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in…
PriorityP344high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
4.81%
91.0th percentile
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Affected
14 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 4.0.0 < 5.2.4.6 | 5.2.4.6 |
| actionpack_project | actionpack | >= 5.2.5 < 5.2.6 | 5.2.6 |
| actionpack_project | actionpack | >= 6.0.0 < 6.0.3.7 | 6.0.3.7 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.3.2 | 6.1.3.2 |
| debian | rails | < rails 2:6.0.3.7+dfsg-1 (bookworm) | rails 2:6.0.3.7+dfsg-1 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | < 5.2.4.6 | 5.2.4.6 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-1 | 2:6.0.3.7+dfsg-1 |
| rubyonrails | rails | >= 5.2.5 < 5.2.6 | 5.2.6 |
| rubyonrails | rails | >= 6.0.0 < 6.0.3.7 | 6.0.3.7 |
| rubyonrails | rails | >= 6.1.0 < 6.1.3.2 | 6.1.3.2 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv7.5HIGH
vendor_debian7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
rails: Possible DoS Vulnerability in Action Controller Token Authentication
vendor_redhat·2021-05-05·CVSS 7.5
CVE-2021-22904 [HIGH] CWE-400 rails: Possible DoS Vulnerability in Action Controller Token Authentication
rails: Possible DoS Vulnerability in Action Controller Token Authentication
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller.
Statement: Red Hat CloudForms 5.0 (CFME 5.11) is in the maintenance phase and we will not be fixing Medium/Low impact security bugs. Reference: https://access.redhat.com/su
Debian
CVE-2021-22904: rails - The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a p...
vendor_debian·2021·CVSS 7.5
CVE-2021-22904 [HIGH] CVE-2021-22904: rails - The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a p...
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
Scope: local
bookworm: resolved (fixed in 2:6.0.3.7+dfsg-1)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-1)
forky: resolved (fixed in 2:6.0.3.7+dfsg-1)
sid: resolved (fixed in 2:6.0.3.7+dfsg-1)
trixie: resolved (fixed in 2:6.0.3.7+dfsg-1)
OSV
CVE-2021-22904: The actionpack ruby gem before 6
osv·2021-06-11·CVSS 7.5
CVE-2021-22904 [HIGH] CVE-2021-22904: The actionpack ruby gem before 6
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
GHSA
Possible DoS Vulnerability in Action Controller Token Authentication
ghsa·2021-05-05
CVE-2021-22904 [HIGH] CWE-400 Possible DoS Vulnerability in Action Controller Token Authentication
Possible DoS Vulnerability in Action Controller Token Authentication
There is a possible DoS vulnerability in the Token Authentication logic in Action Controller.
Versions Affected: >= 4.0.0
Not affected: < 4.0.0
Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact
Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication. Impacted code will look something like this:
```
class PostsController < ApplicationController
before_action :authenticate
private
def authenticate
authenticate_or_request_with_http_token do |token, options|
# ...
end
end
end
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
OSV
Possible DoS Vulnerability in Action Controller Token Authentication
osv·2021-05-05
CVE-2021-22904 [HIGH] Possible DoS Vulnerability in Action Controller Token Authentication
Possible DoS Vulnerability in Action Controller Token Authentication
There is a possible DoS vulnerability in the Token Authentication logic in Action Controller.
Versions Affected: >= 4.0.0
Not affected: < 4.0.0
Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact
Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication. Impacted code will look something like this:
```
class PostsController < ApplicationController
before_action :authenticate
private
def authenticate
authenticate_or_request_with_http_token do |token, options|
# ...
end
end
end
```
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869https://hackerone.com/reports/1101125https://security.netapp.com/advisory/ntap-20210805-0009/https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869https://hackerone.com/reports/1101125https://security.netapp.com/advisory/ntap-20210805-0009/
2021-06-11
Published