CVE-2021-22881

Description

The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Weakness classification

• support@hackerone.com: CWE-601
• nvd@nist.gov: CWE-601

Primary references

• support@hackerone.com — Mailing List, Mitigation, Third Party Advisory
• support@hackerone.com — Mailing List, Mitigation, Third Party Advisory
• support@hackerone.com — Exploit, Mailing List, Patch
• support@hackerone.com — Patch, Third Party Advisory
• support@hackerone.com — Mitigation, Patch, Vendor Advisory
• support@hackerone.com — Exploit, Patch, Third Party Advisory
• support@hackerone.com
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mailing List, Mitigation, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Exploit, Mailing List, Patch
• af854a3a-2127-422b-91ae-364da2661108 — Patch, Third Party Advisory
• af854a3a-2127-422b-91ae-364da2661108 — Mitigation, Patch, Vendor Advisory