CVE-2021-22903: rubyonrails rails Open Redirect
Vulnerability summary
CVE-2021-22903 is a medium (CVSS 6.1) Open Redirect vulnerability in rubyonrails rails. EPSS estimates a 1.23% chance of exploitation in the next 30 days, higher than 68.4% of scored vulnerabilities.
Timeline
- 11-06-2021PublishedVulnerability first disclosed.
- 03-08-2024Last modifiedVulnerability information updated.
Description
The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.
CVSS metrics
4 scores · 3 sources · 2 versions- OSV · UbuntuEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
- OSV · RubygemsEcosystem advisory · calculated6.1MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
EPSS trend
Probability
1.23%
Chance of exploitation in the next 30 days
Percentile
68%
Versus all other CVEs
30-day change
+0.01 pp
From 1.22% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
RubyGems1 product
- actionpack≥ 6.1.0.rc2, < 6.1.3.2
Rubyonrails1 product
- railsEOL≥ 6.1.1, < 6.1.3.2 | 6.1.0:rc2
Ubuntu1 product
- railsAll versions (No fix recorded)
3 vendors · 3 products
References
8 links- discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867X Refsource MISCWEBMitigationPatchVendor Advisory
