CVE-2021-22903
Description
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Vendor advisory: debian — https://security-tracker.debian.org/tracker/CVE-2021-22903
Vendor advisory: suse — https://www.suse.com/security/cve/CVE-2021-22903.html
OS impact
| OS | Version | Status | Fixed in |
|---|---|---|---|
| arch | affected | | |
| sles | affected | | |
| debian | bookworm | fixed | 0 |
| debian | bullseye | fixed | 0 |
| debian | forky | fixed | 0 |
| debian | sid | fixed | 0 |
| debian | trixie | fixed | 0 |
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| RubyGems | actionpack | !< 6.1.0.rc2||<>= 6.1.3.2 | >= 6.1.3.2 |
| RubyGems | actionpack | >=6.1.0.rc2,<6.1.3.2 | 6.1.3.2 |
References
- https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0
- https://www.suse.com/security/cve/CVE-2021-22903.html
- https://nvd.nist.gov/vuln/detail/CVE-2021-22903
- https://hackerone.com/reports/1148025
- https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867
- https://github.com/rails/rails/releases/tag/v6.1.3.2
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.yml
- https://security-tracker.debian.org/tracker/CVE-2021-22903
Verify integrity in audit chain (admin only). AS-IS.