PT-2021-4062 · Ruby · Action Pack

Jonathan Hefner · Published 2021-05-01 · Updated 2021-10-21 · CVE-2021-22903

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions actionpack ruby gem versions prior to 6.1.3.2

Description The issue is related to the conversion of strings in config.hosts to regular expressions without proper escaping, which can lead to an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. For example, if config.hosts includes a string like "sub.example.com" without a leading dot, it can permit a request with a Host header value of "sub-example.com". This vulnerability is similar to a previously known issue.

Recommendations To resolve the issue, update the actionpack ruby gem to version 6.1.3.2 or later. For versions prior to 6.1.3.2, a monkey patch can be applied as a workaround by adding the following code to an initializer:

class ActionDispatch::HostAuthorization::Permissions
 def sanitize string(host)
  if host.start with?(".")
   /A(.+.)?#{Regexp.escape(host[1..-1])}z/i
  else
   /A#{Regexp.escape host}z/i
  end
 end
end

Patches are also available for the 6.1 series.

Exploit

Fix

Open Redirect

Weakness Enumeration

CWE-601

Related Identifiers

BDU:2021-04602

CVE-2021-22903

GHSA-5HQ2-XF89-9JXQ

Affected Products

Action Pack

References · 15

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.yml · Exploit
• https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2021-22903 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2021-22903 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-22903 · Security Note
• https://ubuntu.com/security/CVE-2021-22903 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-22903 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2021-22903 · Security Note
• https://osv.dev/vulnerability/GHSA-5hq2-xf89-9jxq · Vendor Advisory
• https://bdu.fstec.ru/vul/2021-04602 · Security Note
• https://github.com/rails/rails/releases/tag/v6.1.3.2 · Note
• https://github.com/rails/rails/commit/55e0723846aa77ce6afcb677618578fb859b7fd7 · Note
• https://hackerone.com/reports/1148025 · Note
• https://github.com/advisories/GHSA-5hq2-xf89-9jxq · Note
• https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0 · Note