The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability.

Summary

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Timeline

1. Feb 11, 2021, 4:12 PM UTCCVE published
2. Aug 3, 2024, 6:58 PM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a https://github.com/rails/rails

  Version range not reported

• actionpackRubyGems

  From 6.0.0 · fixed in 6.0.3.5

• actionpackRubyGems

  From 6.1.0 · fixed in 6.1.2.1

References 8