PT-2021-15252 · Ruby On Rails+1 · Action Pack+1

Tktech · Published 2021-02-11 · Updated 2026-01-21 · CVE-2021-22881

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Ruby on Rails versions prior to 6.1.2.1 Ruby on Rails versions prior to 6.0.3.5

Description The Host Authorization middleware in Action Pack is susceptible to an open redirect. Specifically crafted Host headers, when used with certain "allowed host" formats, can cause the middleware to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website. The vulnerability resides in the handling of the Host header and the allowed host configuration.

Recommendations Update to Ruby on Rails version 6.1.2.1 or later. Update to Ruby on Rails version 6.0.3.5 or later.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

ALT-PU-2021-2693

CVE-2021-22881

GHSA-8877-PRQ4-9XFW

OPENSUSE-SU-2024:11318-1

OPENSUSE-SU-2024:11821-1

Affected Products

Alt Linux

Action Pack

References · 40

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.yml · Exploit
• 🔥 https://hackerone.com/reports/1047447 · Exploit
• 🔥 http://openwall.com/lists/oss-security/2021/12/14/5 · Exploit
• https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization · Patch
• https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/[e-mail]/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22881 · Vendor Advisory
• https://osv.dev/vulnerability/openSUSE-SU-2024:11821-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2021-22881 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22881 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22881 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2021-22881 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22881 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-8877-prq4-9xfw · Vendor Advisory
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3 · Vendor Advisory