Miggo Logo
Miggo Vulnerability Database
→
CVE-2021-44528

CVE-2021-44528: actionpack Open Redirect in Host Authorization Middleware

6.1

CVSS Score
3.1

Basic Information

CVE ID
CVE-2021-44528
GHSA ID
GHSA-qphc-hf5q-v8fc
EPSS Score
0.96111%
CWE
CWE-601
Published
12/14/2021
Updated
2/18/2024
KEV Status
No
Technology
TechnologyRuby

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
actionpackrubygems>= 6.0.0, <= 6.0.4.16.0.4.2
actionpackrubygems>= 6.1.0, <= 6.1.4.16.1.4.2

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from two key functions: 1) The regex in sanitize_string (original pattern /\A(.+.)?...) allowed invalid domain characters when hosts were configured with leading dots. 2) The authorized? method's use of slice(VALID_FORWARDED_HOST) didn't properly handle multi-value headers or invalid host formats. The patch fixes these by restricting the regex to [a-z0-9-] characters and splitting X-Forwarded-Host values properly. The test cases added in the commit demonstrate exploitation scenarios involving malformed hosts and multiple forwarded hosts.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

Sp**i*lly *r**t** "X-*orw*r***-*ost" *****rs in *om*in*tion wit* **rt*in "*llow** *ost" *orm*ts **n **us* t** *ost *ut*oriz*tion mi**l*w*r* in **tion P**k to r**ir**t us*rs to * m*li*ious w**sit*. Imp**t** *ppli**tions will **v* *llow** *osts wit* *

Reasoning

T** vuln*r**ility st*ms *rom two k*y *un*tions: *) T** r***x in s*nitiz*_strin* (ori*in*l p*tt*rn /\*(.+\.)?...) *llow** inv*li* *om*in ***r**t*rs w**n *osts w*r* *on*i*ur** wit* l***in* *ots. *) T** *ut*oriz**? m*t*o*'s us* o* sli**(V*LI*_*ORW*R***_