{"id":"CVE-2021-22942","aliases":["DEBIAN-CVE-2021-22942","DSA-5372-1","EUVD-2021-1517","GHSA-2rqw-v265-jf8c","UBUNTU-CVE-2021-22942","openSUSE-SU-2024:11821-1"],"status":"published","title":"Open Redirect in ActionPack","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-11","score":0.01695,"percentile":0.77439,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-601"],"published":"2021-08-26T20:36:51Z","modified":"2026-10-24T10:30:33Z","fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["6.0.4.1","6.1.4.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.4.1+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:6.1.4.1+dfsg-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:6.1.4.1+dfsg-3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"last_affected":"6.0.4"},{"fixed":"6.0.4.1"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"last_affected":"6.1.4"},{"fixed":"6.1.4.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.1+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.1+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.4.1+dfsg-3"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0.3.7+dfsg-2+deb11u1"}]}],"versions":["2:6.0.3.7+dfsg-2"],"bundled":10},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.0.0"},{"fixed":"6.0.4.1"}]}],"versions":["6.0.0","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.4.1"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4"]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-6.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.0.4.4-1.1"}]}],"bundled":12}],"products":[{"vendor":"rails","product":"https://github.com/rails/rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/","tags":["x_transferred","Mitigation","Vendor Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2021/12/14/5","tags":["mailing-list","x_transferred","Mailing List","Patch","Third Party Advisory","fix","web"]},{"url":"https://www.debian.org/security/2023/dsa-5372","tags":["vendor-advisory","x_transferred","advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20240202-0005/","tags":["x_transferred","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2021-22942","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/cve-2021-22942","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22942.yml","tags":["web"]},{"url":"https://groups.google.com/g/rubyonrails-security/c/wB5tRn7h36c","tags":["web"]},{"url":"https://rubygems.org/gems/actionpack","tags":["web"]},{"url":"https://github.com/advisories/GHSA-2rqw-v265-jf8c"},{"url":"https://security-tracker.debian.org/tracker/CVE-2021-22942","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://security.netapp.com/advisory/ntap-20240202-0005","tags":["web"]},{"url":"https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2021-22942","tags":["report"]},{"url":"https://www.openwall.com/lists/oss-security/2021/08/20/1","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2021-22942","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2019-16782","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2019-5418","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8164","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8166","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2020-8264","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22881","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22902","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22904","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-22942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2021-44528","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2021-22942","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T00:00:00Z","modified":"2024-08-03T18:58:26.009Z","cwes":["CWE-601"],"updated_at":"2026-11-02T14:32:57.368269Z"}],"euvd":[{"id":"EUVD-2021-1517","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T00:00:00Z","modified":"2024-08-03T18:58:26Z","updated_at":"2026-11-03T03:25:00.591933Z"}],"ghsa":[{"id":"GHSA-2rqw-v265-jf8c","title":"Open Redirect in ActionPack","description":"# Overview\n\nThere is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.\n\nVersions Affected: \u003e= 6.0.0.\nNot affected: \u003c 6.0.0\nFixed Versions: 6.1.4.1, 6.0.4.1\n\n# Impact\n\nSpecially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.\n\nImpacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:\n\n```ruby\nconfig.hosts \u003c\u003c  '.EXAMPLE.com'\n```\n\nWhen an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.\n\nThis vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.\n\n# Releases\n\nThe fixed releases are available at the normal locations.\n\n# Workarounds\n\nIn the case a patch can’t be applied, the following monkey patch can be used in an initializer:\n\n```ruby\nmodule ActionDispatch\n  class HostAuthorization\n    HOSTNAME = /[a-z0-9.-]+|\\[[a-f0-9]*:[a-f0-9.:]+\\]/i\n    VALID_ORIGIN_HOST = /\\A(#{HOSTNAME})(?::\\d+)?\\z/\n    VALID_FORWARDED_HOST = /(?:\\A|,[ ]?)(#{HOSTNAME})(?::\\d+)?\\z/\n\n    private\n      def authorized?(request)\n        origin_host =\n          request.get_header(\"HTTP_HOST\")\u0026.slice(VALID_ORIGIN_HOST, 1) || \"\"\n        forwarded_host =\n          request.x_forwarded_host\u0026.slice(VALID_FORWARDED_HOST, 1) || \"\"\n        @permissions.allows?(origin_host) \u0026\u0026\n          (forwarded_host.blank? || @permissions.allows?(forwarded_host))\n      end\n  end\nend\n```\n","status":"published","published":"2021-08-26T20:36:51Z","modified":"2024-02-02T16:47:03Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:37:34.405364Z"}],"nvd":[{"id":"CVE-2021-22942","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T13:15:09.323Z","modified":"2026-06-17T03:38:04.503Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":5.8,"vector":"AV:N/AC:M/Au:N/C:P/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T14:06:59.689345Z"}],"osv":[{"id":"CVE-2021-22942","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T13:15:09.323Z","modified":"2026-10-24T10:30:33.638222231Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:18.367807Z"},{"id":"DEBIAN-CVE-2021-22942","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T13:15:09.323Z","modified":"2026-10-23T18:03:11.667265159Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:34.637046Z"},{"id":"GHSA-2rqw-v265-jf8c","title":"Open Redirect in ActionPack","description":"# Overview\n\nThere is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.\n\nVersions Affected: \u003e= 6.0.0.\nNot affected: \u003c 6.0.0\nFixed Versions: 6.1.4.1, 6.0.4.1\n\n# Impact\n\nSpecially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.\n\nImpacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:\n\n```ruby\nconfig.hosts \u003c\u003c  '.EXAMPLE.com'\n```\n\nWhen an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.\n\nThis vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.\n\n# Releases\n\nThe fixed releases are available at the normal locations.\n\n# Workarounds\n\nIn the case a patch can’t be applied, the following monkey patch can be used in an initializer:\n\n```ruby\nmodule ActionDispatch\n  class HostAuthorization\n    HOSTNAME = /[a-z0-9.-]+|\\[[a-f0-9]*:[a-f0-9.:]+\\]/i\n    VALID_ORIGIN_HOST = /\\A(#{HOSTNAME})(?::\\d+)?\\z/\n    VALID_FORWARDED_HOST = /(?:\\A|,[ ]?)(#{HOSTNAME})(?::\\d+)?\\z/\n\n    private\n      def authorized?(request)\n        origin_host =\n          request.get_header(\"HTTP_HOST\")\u0026.slice(VALID_ORIGIN_HOST, 1) || \"\"\n        forwarded_host =\n          request.x_forwarded_host\u0026.slice(VALID_FORWARDED_HOST, 1) || \"\"\n        @permissions.allows?(origin_host) \u0026\u0026\n          (forwarded_host.blank? || @permissions.allows?(forwarded_host))\n      end\n  end\nend\n```\n","status":"published","published":"2021-08-26T20:36:51Z","modified":"2024-02-21T05:31:33.873268Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-601"],"updated_at":"2026-11-02T15:46:34.700741Z"},{"id":"UBUNTU-CVE-2021-22942","description":"A possible open redirect vulnerability in the Host Authorization middleware in Action Pack \u003e= 6.0.0 that could allow attackers to redirect users to a malicious website.","status":"published","published":"2021-10-18T13:15:00Z","modified":"2026-10-17T12:55:24.368515776Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:26.29421Z"},{"id":"DSA-5372-1","title":"rails - security update","status":"published","published":"2023-03-13T00:00:00Z","modified":"2026-03-09T02:11:20.548457Z","updated_at":"2026-11-02T15:46:17.543497Z"},{"id":"openSUSE-SU-2024:11821-1","title":"ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.1-rubygem-actionpack-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:34:58.241748Z","updated_at":"2026-11-02T16:58:35.195147Z"}]}}