CVE-2021-22885: Infoleak
A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the redirectto or polymorphicurl helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality.
Other sources
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirectto or polymorphicurlhelper with untrusted user input.
There is a possible information disclosure / unintended method execution vulnerability in Action Pack which has been assigned the CVE identifier CVE-2021-22885.
Versions Affected: >= 2.0.0. Not affected: < 2.0.0. Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact ------ There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirectto or polymorphicurl helper with untrusted user input.
Vulnerable code will look like this:
redirectto(params[:someparam])
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases -------- The FIXED releases are available at the normal locations.
Workarounds ----------- To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example:
private def check(param) case param when "valid" param else "/" end end
def index redirectto(check(params[:someparam])) end
Or force the user input to be cast to a string like this:
def index redirectto(params[:someparam].tos) end
Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
5-2-information-disclosure.patch - Patch for 5.2 series 6-0-information-disclosure.patch - Patch for 6.0 series 6-1-information-disclosure.patch - Patch for 6.1 series
Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
References:
https://www.openwall.com/lists/oss-security/2021/05/05/3
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/tfm-rubygem-actionpackto a version that resolves this vulnerability.Fixed in 0:6.0.3.7-1.el7 - Upgrade
Upgrade
debian/railsto a version that resolves this vulnerability.Fixed in 2:5.2.2.1+dfsg-1+deb10u3Fixed in 2:5.2.2.1+dfsg-1+deb10u5Fixed in 2:6.0.3.7+dfsg-2+deb11u2Fixed in 2:6.1.7.3+dfsg-1Fixed in 2:6.1.7.3+dfsg-2 - Upgrade
Upgrade
redhat/rubygem-actionpackto a version that resolves this vulnerability.Fixed in 6.1.3.2 - Upgrade
Upgrade
redhat/rubygem-actionpackto a version that resolves this vulnerability.Fixed in 6.0.3.7 - Upgrade
Upgrade
redhat/rubygem-actionpackto a version that resolves this vulnerability.Fixed in 5.2.4.6 - Upgrade
Upgrade
redhat/rubygem-actionpackto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade
rubygem-actionpackto a version that resolves this vulnerability.Fixed in 6.1.3.2 - Upgrade
Upgrade
rubygem-actionpackto a version that resolves this vulnerability.Fixed in 6.0.3.7 - Upgrade
Upgrade
rubygem-actionpackto a version that resolves this vulnerability.Fixed in 5.2.4.6 - Upgrade
Upgrade
rubygem-actionpackto a version that resolves this vulnerability.Fixed in 5.2.6 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 5-2-information-disclosure.patch - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6-0-information-disclosure.patch - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 6-1-information-disclosure.patch - Configuration
To mitigate CVE-2021-22885 without upgrading immediately, ensure that parameters passed from untrusted user input to the `redirect_to` or `polymorphic_url` helpers are cast to a string before use (example: `redirect_to(params[:some_param].to_s)`).
rubygem-actionpack (Action Pack) redirect_to / polymorphic_url helper user input handling = cast untrusted user input to a string before use (e.g., redirect_to(params[:some_param].to_s) )
Event History
Frequently Asked Questions
What is CVE-2021-22885?
CVE-2021-22885 is a possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.
What is the severity of CVE-2021-22885?
CVE-2021-22885 has a severity value of 7.5, classifying it as high.
Which software is affected by CVE-2021-22885?
CVE-2021-22885 affects rubygem-actionpack versions 5.2.4.6, 6.0.3.7, and 6.1.3.2.
How can I fix CVE-2021-22885?
To fix CVE-2021-22885, upgrade to rubygem-actionpack version 6.1.3.2, 6.0.3.7, or 5.2.4.6 depending on the version you are using.
Where can I find more information about CVE-2021-22885?
You can find more information about CVE-2021-22885 on the Red Hat Security Advisory page and the Openwall mailing list.