What’s Vulnerable › Vulnerabilities
CVE-2021-22881
- Severity: medium (CVSS 6.1 v3.1)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 87.3% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2021-02-11 · updated 2026-06-17
- Weakness: CWE-601
Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Affected products
- Fedoraproject Fedora: 33
- Ruby on Rails: from 6.0.0 before 6.0.3.5; from 6.1.0 before 6.1.2.1 — fixed in 6.0.3.5, 6.1.2.1
How to fix
Upgrade to a fixed version: Ruby on Rails 6.0.3.5, 6.1.2.1. Check the vendor advisory for mitigations.
References
- http://www.openwall.com/lists/oss-security/2021/05/05/2
- http://www.openwall.com/lists/oss-security/2021/08/20/1
- http://www.openwall.com/lists/oss-security/2021/12/14/5
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130
- https://hackerone.com/reports/1047447
- https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/
- http://www.openwall.com/lists/oss-security/2021/05/05/2
- http://www.openwall.com/lists/oss-security/2021/08/20/1
- http://www.openwall.com/lists/oss-security/2021/12/14/5
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130
Get alerted when CVE-2021-22881 or the next vulnerability affects your stack