CVE-2021-22942
published 2021-10-18CVE-2021-22942: A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious…
PriorityP426medium6.1CVSS 3.1
AVNACLPRNUIRSCCLILAN
EPSS
1.64%
73.7th percentile
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
Affected
12 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| actionpack_project | actionpack | >= 6.0.0 < 6.0.4.2 | 6.0.4.2 |
| actionpack_project | actionpack | >= 6.0.0 < 6.0.4.1 | 6.0.4.1 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.4.2 | 6.1.4.2 |
| actionpack_project | actionpack | >= 6.1.0 < 6.1.4.1 | 6.1.4.1 |
| debian | rails | < rails 2:6.1.4.1+dfsg-3 (bookworm) | rails 2:6.1.4.1+dfsg-3 (bookworm) |
| https | github.com_rails_rails | — | — |
| rubyonrails | rails | >= 0 < 2:6.0.3.7+dfsg-2+deb11u1 | 2:6.0.3.7+dfsg-2+deb11u1 |
| rubyonrails | rails | >= 0 < 2:6.1.4.1+dfsg-3 | 2:6.1.4.1+dfsg-3 |
| rubyonrails | rails | >= 0 < 2:6.1.4.1+dfsg-3 | 2:6.1.4.1+dfsg-3 |
| rubyonrails | rails | >= 0 < 2:6.1.4.1+dfsg-3 | 2:6.1.4.1+dfsg-3 |
| rubyonrails | rails | >= 6.0.0 < 6.0.4.1 | 6.0.4.1 |
| rubyonrails | rails | >= 6.1.0 < 6.1.4.1 | 6.1.4.1 |
CVSS provenance
nvdv3.16.1MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
nvdv2.05.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
ghsa6.1MEDIUM
osv6.1MEDIUM
vendor_debian6.1MEDIUM
vendor_redhat6.1MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
actionpack Open Redirect in Host Authorization Middleware
osv·2021-12-14·CVSS 6.1
CVE-2021-44528 [MEDIUM] actionpack Open Redirect in Host Authorization Middleware
actionpack Open Redirect in Host Authorization Middleware
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release seri
GHSA
actionpack Open Redirect in Host Authorization Middleware
ghsa·2021-12-14·CVSS 6.1
CVE-2021-44528 [MEDIUM] CWE-601 actionpack Open Redirect in Host Authorization Middleware
actionpack Open Redirect in Host Authorization Middleware
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release seri
OSV
CVE-2021-22942: A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6
osv·2021-10-18·CVSS 6.1
CVE-2021-22942 [MEDIUM] CVE-2021-22942: A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
OSV
Open Redirect in ActionPack
osv·2021-08-26·CVSS 6.1
CVE-2021-22942 [MEDIUM] Open Redirect in ActionPack
Open Redirect in ActionPack
# Overview
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1
# Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```ruby
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
T
GHSA
Open Redirect in ActionPack
ghsa·2021-08-26·CVSS 6.1
CVE-2021-22942 [MEDIUM] CWE-601 Open Redirect in ActionPack
Open Redirect in ActionPack
# Overview
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1
# Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
```ruby
config.hosts << '.EXAMPLE.com'
```
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
T
Red Hat
rubygem-actionpack: possible open redirect in the Host Authorization middleware
vendor_redhat·2021-08-20·CVSS 6.1
CVE-2021-22942 [MEDIUM] CWE-601 rubygem-actionpack: possible open redirect in the Host Authorization middleware
rubygem-actionpack: possible open redirect in the Host Authorization middleware
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
A flaw was found in rubygem-actionpack. Specially crafted “X-Forwarded-Host” headers, in combination with certain “allowed host” formats, can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. The highest threat from this vulnerability is to system availability.
Statement: Red Hat Satellite 6 does ship affected version of RubyGem Actionpack, however, product is not vulnerable as it does not set host configuration the vulnerable way.
Package: cfme-gemset (CloudForms Management Engine 5) - Not affe
Debian
CVE-2021-22942: rails - A possible open redirect vulnerability in the Host Authorization middleware in A...
vendor_debian·2021·CVSS 6.1
CVE-2021-22942 [MEDIUM] CVE-2021-22942: rails - A possible open redirect vulnerability in the Host Authorization middleware in A...
A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.
Scope: local
bookworm: resolved (fixed in 2:6.1.4.1+dfsg-3)
bullseye: resolved (fixed in 2:6.0.3.7+dfsg-2+deb11u1)
forky: resolved (fixed in 2:6.1.4.1+dfsg-3)
sid: resolved (fixed in 2:6.1.4.1+dfsg-3)
trixie: resolved (fixed in 2:6.1.4.1+dfsg-3)
No detection rules found.
No public exploits indexed.
http://www.openwall.com/lists/oss-security/2021/12/14/5https://security.netapp.com/advisory/ntap-20240202-0005/https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/https://www.debian.org/security/2023/dsa-5372http://www.openwall.com/lists/oss-security/2021/12/14/5https://security.netapp.com/advisory/ntap-20240202-0005/https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/https://www.debian.org/security/2023/dsa-5372
2021-10-18
Published