{"id":"CVE-2021-22881","published":"2021-02-11T16:12:34Z","modified":"2024-08-03T18:58:24Z","title":"The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability","vendor":null,"product":null,"tier":"core","eol":null,"affectedVersions":[{"vendor":"n/a","product":"https://github.com/rails/rails","versions":["Fixed in 6.1.2.1, 6.0.3.5"]}],"description":{"text":"The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.","provenance":"source","from":"CVE.org"},"summary":{"text":"The Host Authorization middleware in Action Pack, before versions 6.1.2.1 and 6.0.3.5, contains an open redirect flaw. Applications whose allowed hosts begin with a leading dot can have users redirected to a malicious website when a specially crafted Host header is supplied.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-29T07:17:45Z"},"cvss":null,"epss":{"score":0.87301,"percentile":0.99753,"date":"2026-10-31","provenance":"source"},"kev":null,"vulncheckKev":null,"exploited":false,"otx":null,"cwes":[{"id":"CWE-601","name":"URL Redirection to Untrusted Site"}],"references":[{"url":"https://hackerone.com/reports/1047447","tags":["x_refsource_MISC"]},{"url":"https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130","tags":["x_refsource_MISC"]},{"url":"https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/","tags":["x_refsource_MISC"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://www.openwall.com/lists/oss-security/2021/05/05/2","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/08/20/1","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/5","tags":["mailing-list","x_refsource_MLIST"]}],"techniques":[],"reports":[],"affected":[{"ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.5",">=6.1.0, <6.1.2.1"],"patched":["6.0.3.5","6.1.2.1"],"from":["GHSA-8877-prq4-9xfw"],"provenance":"source"}],"advisories":[{"id":"GHSA-8877-prq4-9xfw","url":"https://github.com/advisories/GHSA-8877-prq4-9xfw","severity":"MODERATE","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.0.0, <6.0.3.5"],"patched":["6.0.3.5"],"provenance":"source","from":"GHSA"},{"id":"GHSA-8877-prq4-9xfw","url":"https://github.com/advisories/GHSA-8877-prq4-9xfw","severity":"MODERATE","ecosystem":"RubyGems","package":"actionpack","vulnerableRanges":[">=6.1.0, <6.1.2.1"],"patched":["6.1.2.1"],"provenance":"source","from":"GHSA"}],"euvd":{"id":"EUVD-2021-0631","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2021-0631","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"nuclei":[{"id":"CVE-2021-22881","name":"Ruby on Rails - Open Redirect via Host Header Injection","severity":"medium","path":"http/cves/2021/CVE-2021-22881.yaml","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2021/CVE-2021-22881.yaml"}],"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2021-02-11","kind":"published","label":"Published (CVE.org)","url":"https://www.cve.org/CVERecord?id=CVE-2021-22881","provenance":"source"}],"speed":{"daysToPublicExploit":null,"firstExploitFrom":null,"daysToKev":null},"priority":{"score":25.0,"factors":[{"name":"In a KEV catalog","points":0.0,"detail":"not listed"},{"name":"Recent KEV listing","points":0.0,"detail":"not listed"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":19.95,"detail":"percentile 0.9975"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 nuclei template"},{"name":"Mentioned in OTX pulses","points":0.0,"detail":"0 pulses"},{"name":"CVSS severity","points":0.0,"detail":"no CVSS"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]},"lineage":{"familyId":"fam-actionpack-cve-2021-22881","children":[{"from":"CVE-2021-22881","to":"CVE-2021-22903","relation":"related","confidence":"medium","kind":"lineage","evidence":[{"kind":"text","provenance":"source","relation":"related","quote":"This is similar to CVE-2021-22881.","from":"CVE.org","in":"CVE-2021-22903"},{"kind":"similar","provenance":"machine","score":0.64,"basis":"same package + description similarity"}]}],"packageHistory":[{"cve":"CVE-2020-8166","published":"2020-07-02","fixed":"6.0.3.1","kev":false},{"cve":"CVE-2020-8185","published":"2020-07-02","fixed":"6.0.3.2","kev":false},{"cve":"CVE-2020-8264","published":"2021-01-06","fixed":"6.0.3.4","kev":false,"link":{"from":"CVE-2020-8264","to":"CVE-2021-22881","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.4","toFixed":"6.0.3.5","daysApart":36}]}},{"cve":"CVE-2021-22881","published":"2021-02-11","fixed":"6.1.2.1","kev":false},{"cve":"CVE-2021-22885","published":"2021-05-27","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2021-22881","to":"CVE-2021-22885","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.5","toFixed":"6.0.3.7","daysApart":105}]}},{"cve":"CVE-2021-22902","published":"2021-06-11","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2021-22881","to":"CVE-2021-22902","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.5","toFixed":"6.0.3.7","daysApart":120}]}},{"cve":"CVE-2021-22903","published":"2021-06-11","fixed":"6.1.3.2","kev":false},{"cve":"CVE-2021-22904","published":"2021-06-11","fixed":"6.1.3.2","kev":false,"link":{"from":"CVE-2021-22881","to":"CVE-2021-22904","relation":"successor","confidence":"low","kind":"sequence","evidence":[{"kind":"version-step","provenance":"source","package":"RubyGems:actionpack","fromFixed":"6.0.3.5","toFixed":"6.0.3.7","daysApart":120}]}}],"package":"RubyGems:actionpack"}}