Actionpack Open Redirect Vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
01
beschreibt (1)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2021-22881US | medium6.1 | — | ||
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "… | ||||
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- http://www.openwall.com/lists/oss-security/2021/05/05/2WEB
- http://www.openwall.com/lists/oss-security/2021/08/20/1WEB
- http://www.openwall.com/lists/oss-security/2021/12/14/5WEB
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorizationWEB
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130WEB
- https://github.com/rails/railsWEB
- https://github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.mdWEB
- https://github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444WEB
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan