Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
01
describes (1)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2021-22881US | medium6.1 | — | ||
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "… | ||||
02
references
External citations — patches, advisories, analysis.
- http://www.openwall.com/lists/oss-security/2021/05/05/2WEB
- http://www.openwall.com/lists/oss-security/2021/08/20/1WEB
- http://www.openwall.com/lists/oss-security/2021/12/14/5WEB
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorizationWEB
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130WEB
- https://github.com/rails/railsWEB
- https://github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.mdWEB
- https://github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444WEB
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan