CVE-2021-22942: Actionpack Open Redirect Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-2rqw-v265-jf8c",
  "modified" : "2024-02-02T16:47:01Z",
  "published" : "2021-08-26T20:36:51Z",
  "aliases" : [ "CVE-2021-22942" ],
  "summary" : "Open Redirect in ActionPack",
  "details" : "# Overview\n\nThere is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.\n\nVersions Affected: >= 6.0.0.\nNot affected: < 6.0.0\nFixed Versions: 6.1.4.1, 6.0.4.1\n\n# Impact\n\nSpecially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.\n\nImpacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:\n\n```ruby\nconfig.hosts <<  '.EXAMPLE.com'\n```\n\nWhen an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.\n\nThis vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.\n\n# Releases\n\nThe fixed releases are available at the normal locations.\n\n# Workarounds\n\nIn the case a patch can’t be applied, the following monkey patch can be used in an initializer:\n\n```ruby\nmodule ActionDispatch\n  class HostAuthorization\n    HOSTNAME = /[a-z0-9.-]+|\\[[a-f0-9]*:[a-f0-9.:]+\\]/i\n    VALID_ORIGIN_HOST = /\\A(#{HOSTNAME})(?::\\d+)?\\z/\n    VALID_FORWARDED_HOST = /(?:\\A|,[ ]?)(#{HOSTNAME})(?::\\d+)?\\z/\n\n    private\n      def authorized?(request)\n        origin_host =\n          request.get_header(\"HTTP_HOST\")&.slice(VALID_ORIGIN_HOST, 1) || \"\"\n        forwarded_host =\n          request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || \"\"\n        @permissions.allows?(origin_host) &&\n          (forwarded_host.blank? || @permissions.allows?(forwarded_host))\n      end\n  end\nend\n```\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionpack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.0.0"
      }, {
        "fixed" : "6.0.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.0.4"
    }
  }, {
    "package" : {
      "ecosystem" : "RubyGems",
      "name" : "actionpack"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "6.1.0"
      }, {
        "fixed" : "6.1.4.1"
      } ]
    } ],
    "database_specific" : {
      "last_known_affected_version_range" : "<= 6.1.4"
    }
  } ],
  "references" : [ {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2021-22942"
  }, {
    "type" : "WEB",
    "url" : "https://access.redhat.com/security/cve/cve-2021-22942"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/rails/rails"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22942.yml"
  }, {
    "type" : "WEB",
    "url" : "https://groups.google.com/g/rubyonrails-security/c/wB5tRn7h36c"
  }, {
    "type" : "WEB",
    "url" : "https://rubygems.org/gems/actionpack"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20240202-0005"
  }, {
    "type" : "WEB",
    "url" : "https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5372"
  }, {
    "type" : "WEB",
    "url" : "http://www.openwall.com/lists/oss-security/2021/12/14/5"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-601" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2021-08-26T20:36:25Z",
    "nvd_published_at" : "2021-10-18T13:15:00Z"
  }
}