Vulnerability-Lookup

GSD-2021-22885

Vulnerability from gsd - Updated: 2021-05-05 00:00

Details

There is a possible information disclosure / unintended method execution vulnerability in Action Pack which has been assigned the CVE identifier CVE-2021-22885. Versions Affected: >= 2.0.0. Not affected: < 2.0.0. Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 Impact ------ There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input. Vulnerable code will look like this: ``` redirect_to(params[:some_param]) ``` All users running an affected release should either upgrade or use one of the workarounds immediately. Workarounds ----------- To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example: ``` private def check(param) case param when "valid" param else "/" end end def index redirect_to(check(params[:some_param])) end ``` Or force the user input to be cast to a string like this: ``` def index redirect_to(params[:some_param].to_s) end ```

Aliases

CVE-2021-22885

JSON

To clipboard

{
  "GSD": {
    "alias": "CVE-2021-22885",
    "description": "A possible information disclosure / unintended method execution vulnerability in Action Pack \u003e= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.",
    "id": "GSD-2021-22885",
    "references": [
      "https://www.suse.com/security/cve/CVE-2021-22885.html",
      "https://www.debian.org/security/2021/dsa-4929",
      "https://access.redhat.com/errata/RHSA-2021:4702",
      "https://security.archlinux.org/CVE-2021-22885"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "actionpack",
            "purl": "pkg:gem/actionpack"
          }
        }
      ],
      "aliases": [
        "CVE-2021-22885",
        "GHSA-hjg4-8q5f-x6fm"
      ],
      "details": "There is a possible information disclosure / unintended method execution\nvulnerability in Action Pack which has been assigned the CVE identifier\nCVE-2021-22885.\n\nVersions Affected:  \u003e= 2.0.0.\nNot affected:       \u003c 2.0.0.\nFixed Versions:     6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6\n\nImpact\n------\nThere is a possible information disclosure / unintended method execution\nvulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`\nhelper with untrusted user input.\n\nVulnerable code will look like this:\n\n```\nredirect_to(params[:some_param])\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nTo work around this problem, it is recommended to use an allow list for valid\nparameters passed from the user.  For example:\n\n```\nprivate def check(param)\n  case param\n  when \"valid\"\n    param\n  else\n    \"/\"\n  end\nend\n\ndef index\n  redirect_to(check(params[:some_param]))\nend\n```\n\nOr force the user input to be cast to a string like this:\n\n```\ndef index\n  redirect_to(params[:some_param].to_s)\nend\n```\n",
      "id": "GSD-2021-22885",
      "modified": "2021-05-05T00:00:00.000Z",
      "published": "2021-05-05T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "Possible Information Disclosure / Unintended Method Execution in Action Pack"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2021-22885",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rails/rails",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "n/a"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "A possible information disclosure / unintended method execution vulnerability in Action Pack \u003e= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Information Exposure Through an Error Message (CWE-209)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "https://hackerone.com/reports/1106652",
            "refsource": "MISC",
            "url": "https://hackerone.com/reports/1106652"
          },
          {
            "name": "DSA-4929",
            "refsource": "DEBIAN",
            "url": "https://www.debian.org/security/2021/dsa-4929"
          },
          {
            "name": "https://security.netapp.com/advisory/ntap-20210805-0009/",
            "refsource": "CONFIRM",
            "url": "https://security.netapp.com/advisory/ntap-20210805-0009/"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2021-22885",
      "cvss_v3": 7.5,
      "date": "2021-05-05",
      "description": "There is a possible information disclosure / unintended method execution\nvulnerability in Action Pack which has been assigned the CVE identifier\nCVE-2021-22885.\n\nVersions Affected:  \u003e= 2.0.0.\nNot affected:       \u003c 2.0.0.\nFixed Versions:     6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6\n\nImpact\n------\nThere is a possible information disclosure / unintended method execution\nvulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`\nhelper with untrusted user input.\n\nVulnerable code will look like this:\n\n```\nredirect_to(params[:some_param])\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nTo work around this problem, it is recommended to use an allow list for valid\nparameters passed from the user.  For example:\n\n```\nprivate def check(param)\n  case param\n  when \"valid\"\n    param\n  else\n    \"/\"\n  end\nend\n\ndef index\n  redirect_to(check(params[:some_param]))\nend\n```\n\nOr force the user input to be cast to a string like this:\n\n```\ndef index\n  redirect_to(params[:some_param].to_s)\nend\n```\n",
      "framework": "rails",
      "gem": "actionpack",
      "ghsa": "hjg4-8q5f-x6fm",
      "patched_versions": [
        "~\u003e 5.2.4.6",
        "~\u003e 5.2.6",
        "~\u003e 6.0.3, \u003e= 6.0.3.7",
        "\u003e= 6.1.3.2"
      ],
      "title": "Possible Information Disclosure / Unintended Method Execution in Action Pack",
      "unaffected_versions": [
        "\u003c 2.0.0"
      ],
      "url": "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "",
          "affected_versions": "All versions",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-209",
            "CWE-937"
          ],
          "date": "2022-04-06",
          "description": "There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.",
          "fixed_versions": [],
          "identifier": "CVE-2021-22885",
          "identifiers": [
            "CVE-2021-22885"
          ],
          "not_impacted": "",
          "package_slug": "gem/actionpack-page_caching",
          "pubdate": "2021-05-27",
          "solution": "Unfortunately, there is no solution available yet.",
          "title": "Possible Information Disclosure / Unintended Method Execution",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-22885",
            "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
          ],
          "uuid": "4e0aec10-fa15-46f8-8692-6335f8766ed6"
        },
        {
          "affected_range": "\u003e=5.2.0.0 \u003c5.2.4.6||\u003e=6.0.0.0 \u003c6.0.3.7||\u003e=6.1.0.0 \u003c6.1.3.1",
          "affected_versions": "All versions starting from 5.2.0.0 before 5.2.4.6, all versions starting from 6.0.0.0 before 6.0.3.7, all versions starting from 6.1.0.0 before 6.1.3.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-209",
            "CWE-937"
          ],
          "date": "2021-08-05",
          "description": "A possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.",
          "fixed_versions": [
            "5.2.4.6",
            "6.0.3.7",
            "6.1.3.1"
          ],
          "identifier": "CVE-2021-22885",
          "identifiers": [
            "CVE-2021-22885"
          ],
          "not_impacted": "All versions before 5.2.0.0, all versions starting from 5.2.4.6 before 6.0.0.0, all versions starting from 6.0.3.7 before 6.1.0.0, all versions starting from 6.1.3.1",
          "package_slug": "gem/actionpack",
          "pubdate": "2021-05-27",
          "solution": "Upgrade to versions 5.2.4.6, 6.0.3.7, 6.1.3.1 or above.",
          "title": "Generation of Error Message Containing Sensitive Information",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-22885",
            "https://hackerone.com/reports/1106652",
            "https://www.debian.org/security/2021/dsa-4929",
            "https://security.netapp.com/advisory/ntap-20210805-0009/"
          ],
          "uuid": "9e4de2bb-dc45-4aaf-bcbc-daf6c01e7993"
        },
        {
          "affected_range": "\u003e=5.2.0.0 \u003c5.2.4.6||\u003e=6.0.0.0 \u003c6.0.3.7||\u003e=6.1.0.0 \u003c6.1.3.1",
          "affected_versions": "All versions starting from 5.2.0.0 before 5.2.4.6, all versions starting from 6.0.0.0 before 6.0.3.7, all versions starting from 6.1.0.0 before 6.1.3.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-209",
            "CWE-937"
          ],
          "date": "2022-04-06",
          "description": "There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.",
          "fixed_versions": [
            "5.2.4.6",
            "6.0.3.7",
            "6.1.3.1"
          ],
          "identifier": "CVE-2021-22885",
          "identifiers": [
            "CVE-2021-22885"
          ],
          "not_impacted": "All versions before 5.2.0.0, all versions starting from 5.2.4.6 before 6.0.0.0, all versions starting from 6.0.3.7 before 6.1.0.0, all versions starting from 6.1.3.1",
          "package_slug": "gem/rails",
          "pubdate": "2021-05-27",
          "solution": "Upgrade to versions 5.2.4.6, 6.0.3.7, 6.1.3.1 or above.",
          "title": "Possible Information Disclosure / Unintended Method Execution",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2021-22885",
            "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
          ],
          "uuid": "29cfd473-6e50-49a2-8fa7-064a2d70b0b6"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.2.4.6",
                "versionStartIncluding": "5.2.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.0.3.7",
                "versionStartIncluding": "6.0.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "6.1.3.1",
                "versionStartIncluding": "6.1.0.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:actionpack_page-caching:-:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2021-22885"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "A possible information disclosure / unintended method execution vulnerability in Action Pack \u003e= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "CWE-209"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1106652",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory"
              ],
              "url": "https://hackerone.com/reports/1106652"
            },
            {
              "name": "DSA-4929",
              "refsource": "DEBIAN",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://www.debian.org/security/2021/dsa-4929"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210805-0009/",
              "refsource": "CONFIRM",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://security.netapp.com/advisory/ntap-20210805-0009/"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2022-04-06T16:58Z",
      "publishedDate": "2021-05-27T12:15Z"
    }
  }
}

CVE-2021-22885 (GCVE-0-2021-22885)

Vulnerability from cvelistv5 – Published: 2021-05-27 11:15 – Updated: 2024-08-03 18:58

Summary

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

Severity

No CVSS data available.

CWE

CWE-209 - Information Exposure Through an Error Message (CWE-209)

Assigner

hackerone mitre root

References

3 references

URL	Tags
https://hackerone.com/reports/1106652	x_refsource_MISC
https://www.debian.org/security/2021/dsa-4929	vendor-advisoryx_refsource_DEBIAN
https://security.netapp.com/advisory/ntap-2021080…	x_refsource_CONFIRM

Impacted products

1 product

Vendor	Product	Version
n/a	https://github.com/rails/rails	Affected: 6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T18:58:24.813Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://hackerone.com/reports/1106652"
          },
          {
            "name": "DSA-4929",
            "tags": [
              "vendor-advisory",
              "x_refsource_DEBIAN",
              "x_transferred"
            ],
            "url": "https://www.debian.org/security/2021/dsa-4929"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://security.netapp.com/advisory/ntap-20210805-0009/"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "https://github.com/rails/rails",
          "vendor": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "A possible information disclosure / unintended method execution vulnerability in Action Pack \u003e= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-209",
              "description": "Information Exposure Through an Error Message (CWE-209)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2021-08-05T11:07:16.000Z",
        "orgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
        "shortName": "hackerone"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://hackerone.com/reports/1106652"
        },
        {
          "name": "DSA-4929",
          "tags": [
            "vendor-advisory",
            "x_refsource_DEBIAN"
          ],
          "url": "https://www.debian.org/security/2021/dsa-4929"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://security.netapp.com/advisory/ntap-20210805-0009/"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "support@hackerone.com",
          "ID": "CVE-2021-22885",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "https://github.com/rails/rails",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "6.1.3.1, 6.0.3.7, 5.2.4.6, 5.2.6"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "n/a"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A possible information disclosure / unintended method execution vulnerability in Action Pack \u003e= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Information Exposure Through an Error Message (CWE-209)"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://hackerone.com/reports/1106652",
              "refsource": "MISC",
              "url": "https://hackerone.com/reports/1106652"
            },
            {
              "name": "DSA-4929",
              "refsource": "DEBIAN",
              "url": "https://www.debian.org/security/2021/dsa-4929"
            },
            {
              "name": "https://security.netapp.com/advisory/ntap-20210805-0009/",
              "refsource": "CONFIRM",
              "url": "https://security.netapp.com/advisory/ntap-20210805-0009/"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "36234546-b8fa-4601-9d6f-f4e334aa8ea1",
    "assignerShortName": "hackerone",
    "cveId": "CVE-2021-22885",
    "datePublished": "2021-05-27T11:15:32.000Z",
    "dateReserved": "2021-01-06T00:00:00.000Z",
    "dateUpdated": "2024-08-03T18:58:24.813Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

GHSA-HJG4-8Q5F-X6FM

Vulnerability from github – Published: 2021-05-05 19:49 – Updated: 2023-07-05 20:17

Summary

Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

Details

Impact

There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirect_to or polymorphic_url helper with untrusted user input.

Vulnerable code will look like this.

redirect_to(params[:some_param])

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The FIXED releases are available at the normal locations.

Workarounds

To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example,

private def check(param)
  case param
  when "valid"
    param
  else
    "/"
  end
end

def index
  redirect_to(check(params[:some_param]))
end

Or force the user input to be cast to a string like this,

def index
  redirect_to(params[:some_param].to_s)
end

Patches

To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

5-2-information-disclosure.patch - Patch for 5.2 series
6-0-information-disclosure.patch - Patch for 6.0 series
6-1-information-disclosure.patch - Patch for 6.1 series

Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.

Credits

Thanks to Benoit Côté-Jodoin from Shopify for reporting this.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.0.3.6"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.0.0"
            },
            {
              "fixed": "6.0.3.7"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 6.1.3.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "6.1.0"
            },
            {
              "fixed": "6.1.3.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.5"
            },
            {
              "fixed": "5.2.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.2.4.5"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionpack"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "2.0.0"
            },
            {
              "fixed": "5.2.4.6"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2021-22885"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-200",
      "CWE-209"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2021-05-05T19:48:10Z",
    "nvd_published_at": "2021-05-27T12:15:00Z",
    "severity": "HIGH"
  },
  "details": "Impact\n------\nThere is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the `redirect_to` or `polymorphic_url` helper with untrusted user input.\n\nVulnerable code will look like this.\n\n```\nredirect_to(params[:some_param])\n```\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\nReleases\n--------\nThe FIXED releases are available at the normal locations.\n\nWorkarounds\n-----------\nTo work around this problem, it is recommended to use an allow list for valid parameters passed from the user.  For example,\n\n```ruby\nprivate def check(param)\n  case param\n  when \"valid\"\n    param\n  else\n    \"/\"\n  end\nend\n\ndef index\n  redirect_to(check(params[:some_param]))\nend\n```\n\nOr force the user input to be cast to a string like this,\n\n```ruby\ndef index\n  redirect_to(params[:some_param].to_s)\nend\n```\n\nPatches\n-------\nTo aid users who aren\u0027t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.\n\n* 5-2-information-disclosure.patch - Patch for 5.2 series\n* 6-0-information-disclosure.patch - Patch for 6.0 series\n* 6-1-information-disclosure.patch - Patch for 6.1 series\n\nPlease note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.\n\nCredits\n-------\n\nThanks to Benoit C\u00f4t\u00e9-Jodoin from Shopify for reporting this.",
  "id": "GHSA-hjg4-8q5f-x6fm",
  "modified": "2023-07-05T20:17:23Z",
  "published": "2021-05-05T19:49:02Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2021-22885"
    },
    {
      "type": "WEB",
      "url": "https://hackerone.com/reports/1106652"
    },
    {
      "type": "WEB",
      "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22885.yml"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
    },
    {
      "type": "WEB",
      "url": "https://security.netapp.com/advisory/ntap-20210805-0009"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Action Pack contains Information Disclosure / Unintended Method Execution vulnerability"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

GSD-2021-22885

CVE-2021-22885 (GCVE-0-2021-22885)

GHSA-HJG4-8Q5F-X6FM

Impact

Releases

Workarounds

Patches

Credits

Tags

Sightings

Nomenclature

Related by attack behaviour