CVE-2021-44528 actionpack Open Redirect in Host Authorization Middleware

What is CVE-2021-44528?

CVE-2021-44528 is a medium-severity vulnerability in Rubyonrails Rails, published on 7 Jan 2022. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Weakness: CWE-601

Which versions are affected by CVE-2021-44528?

5 open source packages ship an affected version, including rails and actionpack. It affects 1 product.

Products include Rubyonrails Rails.

How do I fix CVE-2021-44528?

Apply the vendor's patch.

Is CVE-2021-44528 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2021-44528 exists.

Public exploit code: 1 Nuclei template.

Other vulnerabilities in Rubyonrails Rails

• CVE-2013-0277 Active Record contains deserialization of arbitrary YAML Critical 10.0
• CVE-2017-17916 SQL injection in n/a High 8.1
• CVE-2017-17917 SQL injection in n/a High 8.1
• CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService High 8.0
• CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch High 7.5

All Rubyonrails Rails vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-rails-2021-44528, DEBIAN-CVE-2021-44528, GHSA-qphc-hf5q-v8fc, UBUNTU-CVE-2021-44528.