CVE-2021-22903

    Dashboard / Vulnerabilities / CVE-2021-22903

    CVE-2021-22903

    Published: 11 Jun 2021Last Modified: 9 Sept 2026

    Summary:

    Details: The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.

    References: https://hackerone.com/reports/1148025, https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 5f3ff60084ab5d5921ca3499814e4697f8350ee7
    Fixed -75ac626c4e21129d8296d4206a1960563cc3d4aa

    Affected versions

    6.1.0-rc2

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2021-22903 | CVE-DB