{
  "GSD": {
    "alias": "CVE-2021-22903",
    "description": "The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts \u003c\u003c \"sub.example.com\"` to permit a request with a Host header value of `sub-example.com`.",
    "id": "GSD-2021-22903",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-22903.html",
      "https://security.archlinux.org/CVE-2021-22903"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "actionpack",
            "purl": "pkg:gem/actionpack"
          }
        }
      ],
      "aliases": [
        "CVE-2021-22903",
        "GHSA-5hq2-xf89-9jxq"
      ],
      "details": "There is a possible Open Redirect Vulnerability in Action Pack. This\nvulnerability has been assigned the CVE identifier CVE-2021-22903.\n\nVersions Affected:  \u003e= v6.1.0.rc2\nNot affected:       \u003c v6.1.0.rc2\nFixed Versions:     6.1.3.2\n\nImpact\n------\nThis is similar to CVE-2021-22881: Specially crafted Host headers in\ncombination with certain \"allowed host\" formats can cause the Host\nAuthorization middleware in Action Pack to redirect users to a malicious\nwebsite.\n\nSince rails/rails@9bc7ea5, strings in config.hosts that do not have a leading\ndot are converted to regular expressions without proper escaping. This causes,\nfor example, config.hosts \u003c\u003c \"sub.example.com\" to permit a request with a Host\nheader value of sub-example.com.\n\nWorkarounds\n-----------\nThe following monkey patch put in an initializer can be used as a workaround:\n\n```ruby\nclass ActionDispatch::HostAuthorization::Permissions\n  def sanitize_string(host)\n    if host.start_with?(\".\")\n      /\\A(.+\\.)?#{Regexp.escape(host[1..-1])}\\z/i\n    else\n      /\\A#{Regexp.escape host}\\z/i\n    end\n  end\nend\n```\n",
      "id": "GSD-2021-22903",
      "modified": "2021-05-05T00:00:00.000Z",
      "published": "2021-05-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0"
        }
      ],
      "related": [
        "CVE-2021-22881"
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 6.1,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Possible Open Redirect Vulnerability in Action Pack"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2021-22903",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rails/rails",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "Fixed in 6.1.3.2"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts \u003c\u003c \"sub.example.com\"` to permit a request with a Host header value of `sub-example.com`."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Open Redirect (CWE-601)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/1148025",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1148025"
          },
          {
            "name": "https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867",
            "refsource": "MISC",
            "url": "https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-22903",
      "cvss_v3": 6.1,
      "date": "2021-05-05",
      "description": "There is a possible Open Redirect Vulnerability in Action Pack. This\nvulnerability has been assigned the CVE identifier CVE-2021-22903.\n\nVersions Affected:  \u003e= v6.1.0.rc2\nNot affected:       \u003c v6.1.0.rc2\nFixed Versions:     6.1.3.2\n\nImpact\n------\nThis is similar to CVE-2021-22881: Specially crafted Host headers in\ncombination with certain \"allowed host\" formats can cause the Host\nAuthorization middleware in Action Pack to redirect users to a malicious\nwebsite.\n\nSince rails/rails@9bc7ea5, strings in config.hosts that do not have a leading\ndot are converted to regular expressions without proper escaping. This causes,\nfor example, config.hosts \u003c\u003c \"sub.example.com\" to permit a request with a Host\nheader value of sub-example.com.\n\nWorkarounds\n-----------\nThe following monkey patch put in an initializer can be used as a workaround:\n\n```ruby\nclass ActionDispatch::HostAuthorization::Permissions\n  def sanitize_string(host)\n    if host.start_with?(\".\")\n      /\\A(.+\\.)?#{Regexp.escape(host[1..-1])}\\z/i\n    else\n      /\\A#{Regexp.escape host}\\z/i\n    end\n  end\nend\n```\n",
      "framework": "rails",
      "gem": "actionpack",
      "ghsa": "5hq2-xf89-9jxq",
      "patched_versions": [
        "\u003e= 6.1.3.2"
      ],
      "related": {
        "cve": [
          "2021-22881"
        ]
      },
      "title": "Possible Open Redirect Vulnerability in Action Pack",
      "unaffected_versions": [
        "\u003c 6.1.0.rc2"
      ],
      "url": "https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003c6.1.3.2",
          "affected_versions": "All versions before 6.1.3.2",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2021-06-22",
          "description": "The actionpack ruby gem suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.",
          "fixed_versions": [
            "6.1.3.2"
          ],
          "identifier": "CVE-2021-22903",
          "identifiers": [
            "CVE-2021-22903"
          ],
          "not_impacted": "All versions starting from 6.1.3.2",
          "package_slug": "gem/actionpack",
          "pubdate": "2021-06-11",
          "solution": "Upgrade to version 6.1.3.2 or above.",
          "title": "URL Redirection to Untrusted Site (\u0027Open Redirect\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-22903",
            "https://hackerone.com/reports/1148025"
          ],
          "uuid": "669f8ad3-cea6-4de6-9b47-08c1d9aff085"
        },
        {
          "affected_range": "\u003e=6.1.0 \u003c=6.1.3.2",
          "affected_versions": "All versions starting from 6.1.0 up to 6.1.3.2",
          "cvss_v2": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-601",
            "CWE-937"
          ],
          "date": "2021-10-21",
          "description": "This is similar to CVE-2021-22881. Specially crafted `Host` headers in combination with certain `allowed host` formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.",
          "fixed_versions": [
            "6.1.4"
          ],
          "identifier": "CVE-2021-22903",
          "identifiers": [
            "CVE-2021-22903"
          ],
          "not_impacted": "All versions before 6.1.0, all versions after 6.1.3.2",
          "package_slug": "gem/rails",
          "pubdate": "2021-06-11",
          "solution": "Upgrade to version 6.1.4 or above.",
          "title": "URL Redirection to Untrusted Site (Open Redirect)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-22903",
            "https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0"
          ],
          "uuid": "d83ed165-0122-4c11-a5e2-218de9bb42a6"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:6.1.0:rc2:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.1.3.2",
                "versionStartIncluding": "6.1.1",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2021-22903"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts \u003c\u003c \"sub.example.com\"` to permit a request with a Host header value of `sub-example.com`."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-601"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1148025",
              "refsource": "MISC",
              "tags": [
                "Permissions Required",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/1148025"
            },
            {
              "name": "https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867",
              "refsource": "MISC",
              "tags": [
                "Mitigation",
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "MEDIUM",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.8,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "PARTIAL",
            "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 8.6,
          "impactScore": 4.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": true
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "scope": "CHANGED",
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 2.8,
          "impactScore": 2.7
        }
      },
      "lastModifiedDate": "2021-10-21T14:32Z",
      "publishedDate": "2021-06-11T16:15Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "text": "mittel"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand auszul\u00f6sen und Sicherheitsma\u00dfnahmen zu umgehen.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- UNIX",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2022-0341 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2021/wid-sec-w-2022-0341.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2022-0341 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0341"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:15116-1 vom 2022-12-08",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-December/013203.html"
      },
      {
        "category": "external",
        "summary": "Rails - Rails versions 6.1.3.2, 6.0.3.7, 5.2.4.6, and 5.2.6 have been released! vom 2021-05-05",
        "url": "https://weblog.rubyonrails.org/2021/5/5/Rails-versions-6-1-3-2-6-0-3-7-5-2-4-6-and-5-2-6-have-been-released/"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DLA-2655 vom 2021-05-11",
        "url": "https://lists.debian.org/debian-lts-announce/2021/05/msg00010.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:1650-1 vom 2021-05-19",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-May/008791.html"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2021:1759-1 vom 2021-05-26",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2021-May/008839.html"
      },
      {
        "category": "external",
        "summary": "Debian Security Advisory DSA-4929 vom 2021-06-10",
        "url": "https://www.debian.org/security/2021/dsa-4929"
      },
      {
        "category": "external",
        "summary": "Red Hat Security Advisory RHSA-2021:4702 vom 2021-11-16",
        "url": "https://access.redhat.com/errata/RHSA-2021:4702"
      },
      {
        "category": "external",
        "summary": "SUSE Security Update SUSE-SU-2022:2108-1 vom 2022-06-16",
        "url": "https://lists.suse.com/pipermail/sle-security-updates/2022-June/011300.html"
      }
    ],
    "source_lang": "en-US",
    "title": "Ruby on Rails: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2022-12-08T23:00:00.000+00:00",
      "generator": {
        "date": "2024-02-15T16:48:35.178+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.0"
        }
      },
      "id": "WID-SEC-W-2022-0341",
      "initial_release_date": "2021-05-05T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2021-05-05T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        },
        {
          "date": "2021-05-11T22:00:00.000+00:00",
          "number": "2",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2021-05-19T22:00:00.000+00:00",
          "number": "3",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-05-26T22:00:00.000+00:00",
          "number": "4",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2021-06-10T22:00:00.000+00:00",
          "number": "5",
          "summary": "Neue Updates von Debian aufgenommen"
        },
        {
          "date": "2021-11-16T23:00:00.000+00:00",
          "number": "6",
          "summary": "Neue Updates von Red Hat aufgenommen"
        },
        {
          "date": "2022-06-16T22:00:00.000+00:00",
          "number": "7",
          "summary": "Neue Updates von SUSE aufgenommen"
        },
        {
          "date": "2022-12-08T23:00:00.000+00:00",
          "number": "8",
          "summary": "Neue Updates von SUSE aufgenommen"
        }
      ],
      "status": "final",
      "version": "8"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Debian Linux",
            "product": {
              "name": "Debian Linux",
              "product_id": "2951",
              "product_identification_helper": {
                "cpe": "cpe:/o:debian:debian_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Debian"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Open Source Ruby on Rails \u003c 6.1.3.2",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c 6.1.3.2",
                  "product_id": "T019249",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:6.1.3.2"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Ruby on Rails \u003c 6.0.3.7",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c 6.0.3.7",
                  "product_id": "T019250",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:6.0.3.7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Ruby on Rails \u003c 5.2.4.6",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c 5.2.4.6",
                  "product_id": "T019251",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:5.2.4.6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Open Source Ruby on Rails \u003c 5.2.6",
                "product": {
                  "name": "Open Source Ruby on Rails \u003c 5.2.6",
                  "product_id": "T019252",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:rubyonrails:ruby_on_rails:5.2.6"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Ruby on Rails"
          }
        ],
        "category": "vendor",
        "name": "Open Source"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Red Hat Enterprise Linux",
            "product": {
              "name": "Red Hat Enterprise Linux",
              "product_id": "67646",
              "product_identification_helper": {
                "cpe": "cpe:/o:redhat:enterprise_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      },
      {
        "branches": [
          {
            "category": "product_name",
            "name": "SUSE Linux",
            "product": {
              "name": "SUSE Linux",
              "product_id": "T002207",
              "product_identification_helper": {
                "cpe": "cpe:/o:suse:suse_linux:-"
              }
            }
          }
        ],
        "category": "vendor",
        "name": "SUSE"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2021-22885",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Ruby on Rails. Die Schwachstelle besteht in der Komponente \"Action Pack\". Ein Angreifer kann diese Schwachstelle ausnutzen, um vertrauliche Informationen offenzulegen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646"
        ]
      },
      "release_date": "2021-05-05T22:00:00Z",
      "title": "CVE-2021-22885"
    },
    {
      "cve": "CVE-2021-22902",
      "notes": [
        {
          "category": "description",
          "text": "In Ruby on Rails existieren mehrere Schwachstellen. Die Schwachstellen bestehen in der Token-Authentifizierungslogik in Action Controller und im Mime-Type-Parser von Action Dispatch. Ein Angreifer kann diese Schwachstellen ausnutzen, um eine Denial-of-Service-Bedingung auszul\u00f6sen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646"
        ]
      },
      "release_date": "2021-05-05T22:00:00Z",
      "title": "CVE-2021-22902"
    },
    {
      "cve": "CVE-2021-22904",
      "notes": [
        {
          "category": "description",
          "text": "In Ruby on Rails existieren mehrere Schwachstellen. Die Schwachstellen bestehen in der Token-Authentifizierungslogik in Action Controller und im Mime-Type-Parser von Action Dispatch. Ein Angreifer kann diese Schwachstellen ausnutzen, um eine Denial-of-Service-Bedingung auszul\u00f6sen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646"
        ]
      },
      "release_date": "2021-05-05T22:00:00Z",
      "title": "CVE-2021-22904"
    },
    {
      "cve": "CVE-2021-22903",
      "notes": [
        {
          "category": "description",
          "text": "Es existiert eine Schwachstelle in Ruby on Rails. Die Schwachstelle besteht in der Komponente \"Action Pack\" aufgrund einer m\u00f6glichen Open Redirect-Schwachstelle. Ein Angreifer kann diese Schwachstelle ausnutzen, um Sicherheitsma\u00dfnahmen zu umgehen."
        }
      ],
      "product_status": {
        "known_affected": [
          "2951",
          "T002207",
          "67646"
        ]
      },
      "release_date": "2021-05-05T22:00:00Z",
      "title": "CVE-2021-22903"
    }
  ]
}

{
  "affected": [
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0.rc2"
            },
            {
              "fixed": "6.1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-22903"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-601"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-05T19:47:50Z",
    "nvd_published_at": "2021-06-11T16:15:00Z",
    "severity": "MODERATE"
  },
  "details": "There is a possible Open Redirect Vulnerability in Action Pack.\n\nVersions Affected:  \u003e= v6.1.0.rc2\nNot affected:       \u003c v6.1.0.rc2\nFixed Versions:     6.1.3.2\n\nImpact\n------\nThis is similar to CVE-2021-22881. Specially crafted Host headers in combination with certain \"allowed host\" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious\nwebsite.\n\nSince rails/rails@9bc7ea5, strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts \u003c\u003c \"sub.example.com\" to permit a request with a Host header value of sub-example.com.\n\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nThe following monkey patch put in an initializer can be used as a workaround.\n\n```ruby\nclass ActionDispatch::HostAuthorization::Permissions\n  def sanitize_string(host)\n    if host.start_with?(\".\")\n      /\\A(.+\\.)?#{Regexp.escape(host[1..-1])}\\z/i\n    else\n      /\\A#{Regexp.escape host}\\z/i\n    end\n  end\nend\n```\n\nPatches\n-------\nTo aid users who aren\u0027t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.\n\n* 6-1-open-redirect.patch - Patch for 6.1 series\n\nPlease note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.\n\nCredits\n-------\n\nThanks Jonathan Hefner (https://hackerone.com/jonathanhefner) for reporting this bug!",
  "id": "GHSA-5hq2-xf89-9jxq",
  "modified": "2023-08-08T15:56:26Z",
  "published": "2021-05-05T19:48:29Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22903"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1148025"
    },
    {
      "type": "WEB",
      "url": "https://discuss.rubyonrails.org/t/cve-2021-22903-possible-open-redirect-vulnerability-in-action-pack/77867"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rails/rails/releases/tag/v6.1.3.2"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22903.yml"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Possible Open Redirect Vulnerability in Action Pack"
}