CVE-2021-22881 Public exploit EPSS 87.3%

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability

Summary

The Host Authorization middleware in Action Pack, before versions 6.1.2.1 and 6.0.3.5, contains an open redirect flaw. Applications whose allowed hosts begin with a leading dot can have users redirected to a malicious website when a specially crafted Host header is supplied.

Official description · CVE.org

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Breakdown

25.0 / 100

Exploited: Not confirmed
Reports: 0
Tactics: 0/15

Disclosed on 11 Feb 2021. No public exploit code or confirmed exploitation is recorded.

See the family tree

4 related vulnerabilities in the same code over 11 months. The latest fix listed for actionpack is 6.1.3.2.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

This CVECVE-2021-22881The Host Authorization middleware in Action Pack before 6.1.2.1…11 Feb 2021
relatedMedium
Why these are linked:
- Stated in the CVE textThis is similar to CVE-2021-22881.
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2021-22903The actionpack ruby gem before 6.1.3.2 suffers from a possible…11 Jun 2021
same family
CVE-2021-22942A possible open redirect vulnerability in the Host Authorization…18 Oct 2021
Next fix in the same packageMedium
Why these are linked:
- Fixed one release later6.0.4.1 → 6.0.4.2 (actionpack)
- Similar weakness in the same product (machine-matched)same package + description similarity
CVE-2021-44528A open redirect vulnerability exists in Action Pack >= 6.0.0…7 Jan 2022

Fixes in actionpackRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

6.0.3.1CVE-2020-81662 Jul 2020
6.0.3.2CVE-2020-81852 Jul 2020
6.0.3.4CVE-2020-82646 Jan 2021
6.1.2.1CVE-2021-2288111 Feb 2021
6.1.3.2CVE-2021-2288527 May 2021
6.1.3.2CVE-2021-2290211 Jun 2021
6.1.3.2CVE-2021-2290311 Jun 2021
6.1.3.2CVE-2021-2290411 Jun 2021Latest listed

techniques

No techniques linked

No ATT&CK techniques are linked to this CVE yet. MITRE CTID has not mapped it, and no report passage in the corpus ties it to a technique.

Am I affected? What do I upgrade to?

From GitHub Security Advisories and OSV

1 package in 1 ecosystem. Main package: actionpack.

RubyGemsactionpackGHSA-8877-prq4-9xfw

Upgrade to 6.1.2.1 or later

Gemfilegem "actionpack", ">= 6.1.2.1"

The first fix for CVE-2021-22881.

Affected versions, by release line

If you run	Upgrade to
6.1.0 up to 6.1.2.1	6.1.2.1
6.0.0 up to 6.0.3.5	6.0.3.5

“Up to” means the second version is the fix and is not affected.

Check your lockfile against all CVEs

What security researchers reported

Not named in any threat report yet

References

7 links, grouped by NVD tag

Exploitation evidence

Not in KEV. CISA has not confirmed exploitation.

ENISA

Not marked exploited. EUVD-2021-0631

Public exploitAdvisories link exploit code.

, 31 Oct 2026

87.3%Top 0.25%

Chance of exploitation in the next 30 days. of scored CVEs (riskier than 99.75%).

No CVSS score published.

Priority factorsFormula

In a KEV catalognot listed 0.0/35

Recent KEV listingnot listed 0.0/10

Known ransomware usenot known 0.0/10

EPSS percentilepercentile 0.9975 19.9/20

Threat reports0 reports 0.0/10

Public exploit code1 nuclei template 5.0/5

Mentioned in OTX pulses0 pulses 0.0/3

CVSS base scoreno CVSS 0.0/7

End-of-life productsupported or unknown 0.0

Total25.0

Record

Published: 11 Feb 2021
Modified: 3 Aug 2024
: CWE-601 URL Redirection to Untrusted Site
Elsewhere: NVD CVE.org JSON

Exploitation timelineExploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.

Patch historyPatch historyEarlier and later CVEs in the same code, in date order. It shows when a fix was bypassed or incomplete and which version finally fixed it.

Same bug familyLinked by evidence that a fix failed or the same code was patched again. Oldest first.

Fixes in actionpackRubyGems package, by fixed version. Earlier and later fixes in the same package, not necessarily the same bug.

ATT&CKMITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques

Am I affected? What do I upgrade to?

Affected versions, by release line

What security researchers reported

References

x_refsource_MISC 3

vendor-advisory 1

mailing-list 3

techniques