CVE-2021-22881

Name: CVE-2021-22881
Creator: NVD / NIST
Published: 2021-02-11T18:15:17.46+00:00
License: https://creativecommons.org/publicdomain/zero/1.0/

MEDIUMCVSS 6.1/10EPSS 87.30%

Last modified Jun 17, 2026

CVE-2021-22881 is a medium-severity vulnerability rated 6.1/10 on the CVSS scale. The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. EPSS estimates a 87.30% chance of exploitation in the next 30 days.

Description

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Metrics

CVSS 3.1

6.1/10

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

EPSS Probability

87.30%

99.7th percentile

Probability of exploitation in the next 30 days. Learn more

Weakness Enumeration

Affected Software

Vendor	Product	Versions
Rubyonrails	Rails	>= 6.0.0, < 6.0.3.5
Rubyonrails	Rails	>= 6.1.0, < 6.1.2.1
Fedoraproject	Fedora	33

References

http://www.openwall.com/lists/oss-security/2021/05/05/2Mailing List, Mitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/20/1Mailing List, Mitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/14/5Exploit, Mailing List, Patch
https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/Patch, Third Party Advisory
https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130Mitigation, Patch, Vendor Advisory
https://hackerone.com/reports/1047447Exploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/
http://www.openwall.com/lists/oss-security/2021/05/05/2Mailing List, Mitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/08/20/1Mailing List, Mitigation, Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/12/14/5Exploit, Mailing List, Patch
https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/Patch, Third Party Advisory
https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130Mitigation, Patch, Vendor Advisory
https://hackerone.com/reports/1047447Exploit, Patch, Third Party Advisory
https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/

Timeline

Published: Feb 11, 2021
Last Modified: Jun 17, 2026
Status: Modified

Frequently Asked Questions

What is CVE-2021-22881?

How severe is CVE-2021-22881?

CVE-2021-22881 has a CVSS score of 6.1/10 (MEDIUM severity). The EPSS model estimates a 87.30% probability of exploitation in the next 30 days.

How do I fix CVE-2021-22881?

Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2021-22881?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST