[oss-security] 20210505 [CVE-2021-22903] Possible Open Redirect Vulnerability in Action Packmailing list
http://www.openwall.com/lists/oss-security/2021/05/05/2 CVE-2021-22881
MEDIUMNuclei
Actionpack Open Redirect Vulnerability
Record summary
CVE-2021-22881 has a selected CVSS score of 6.1 (medium); EIP currently links 1 Nuclei template.
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Description source: CVE List
Exploitation context
Available material
- Nuclei templates
- 1
Affected products and versions
2| Product | Source | Version range | Status |
|---|---|---|---|
https://github.com/rails/rails | CVE List | Fixed in 6.1.2.1, 6.0.3.5 | affected |
actionpackBrowse RubyGems / actionpack | GitHub Advisory | 6.0.0 to < 6.0.3.5 · Fixed in 6.0.3.5 | affected |
| 6.1.0 to < 6.1.2.1 · Fixed in 6.1.2.1 | affected |
Nuclei templates
1ProjectDiscoveryMEDIUMRuby on Rails - Open Redirect via Host Header InjectionCVSS 6.1
Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers.
Impact
Attackers can redirect users to malicious sites, potentially leading to phishing or malware distribution.
Remediation
Update to version 6.1.2.1, 6.0.3.5 or later versions.
WeaknessesCWE-601
Authorstheamanrawat
Template tagscvecve2021rubyrailshost-headerredirectvuln
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Source: ProjectDiscovery
References
Showing 12 of 15[oss-security] 20210819 [CVE-2021-22942] Possible Open Redirect in Host Authorization Middlewaremailing list
http://www.openwall.com/lists/oss-security/2021/08/20/1 [oss-security] 20211214 [CVE-2021-44528] Possible Open Redirect in Host Authorization Middlewaremailing list
http://www.openwall.com/lists/oss-security/2021/12/14/5 benjamin-bouchet.com
https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization discuss.rubyonrails.org
https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 github.com
https://github.com/rails/rails github.com
https://github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.md github.com
https://github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444 github.com
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.yml groups.google.com
https://groups.google.com/g/rubyonrails-security/c/zN_3qA26l6E hackerone.com
https://hackerone.com/reports/1047447 FEDORA-2021-b571fca1b8Vendor advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3