CVE-2021-22881: Medium severity rubyonrails Rails vulnerability
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is CVE-2021-22881?
CVE-2021-22881 is an open redirect vulnerability in the Host Authorization middleware in Ruby on Rails before version 6.1.2.1 and 6.0.3.5.
What is the severity of CVE-2021-22881?
CVE-2021-22881 has a severity rating of 6.1, which is considered medium.
Which software versions are affected by CVE-2021-22881?
Ruby on Rails versions before 6.1.2.1 and 6.0.3.5 are affected by CVE-2021-22881.
How does CVE-2021-22881 work?
CVE-2021-22881 can be exploited by sending specially crafted `Host` headers to the vulnerable application, which can lead to an open redirect and redirect users to a malicious website.
Is there a fix available for CVE-2021-22881?
Yes, upgrading to Ruby on Rails version 6.1.2.1 or 6.0.3.5 will fix the vulnerability.