The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host header value of `sub-example.com`.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially     crafted Host headers in combination with certain allowed host formats can cause the Host Authorization     middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881.
    Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper     escaping. This causes, for example, `config.hosts << sub.example.com` to permit a request with a Host     header value of `sub-example.com`. (CVE-2021-22903)

Note that Nessus relies on the presence of the package as reported by the vendor.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially
    crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization
    middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881.
    Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper
    escaping. This causes, for example, `config.hosts << "sub.example.com"` to permit a request with a Host
    header value of `sub-example.com`. (CVE-2021-22903)

Ruby on Rails blog :

Rails versions 6.1.3.2, 6.0.3.7, and 5.2.6 have been released! These releases contain important security fixes. Here is a list of the issues fixed :

CVE-2021-22885: Possible Information Disclosure / Unintended Method Execution in Action Pack

CVE-2021-22902: Possible Denial of Service vulnerability in Action Dispatch

CVE-2021-22903: Possible Open Redirect Vulnerability in Action Pack

CVE-2021-22904: Possible DoS Vulnerability in Action Controller Token Authentication

ID	Name	Product	Family	Type	Severity
257488	Linux Distros Unpatched Vulnerability : CVE-2021-22903	Nessus	Misc.	Local	medium
410867	SCA: security update for actionpack (GHSA-5hq2-xf89-9jxq)	Tenable Cloud Security	SCA Checks	Local	medium
410867	SCA: security update for actionpack (GHSA-5hq2-xf89-9jxq)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
149360	FreeBSD : Rails -- multiple vulnerabilities (f7a00ad7-ae75-11eb-8113-08002728f74c)	Nessus	FreeBSD Local Security Checks	Local	high

Detections

Analytics

CVE-2021-22903

medium

Tenable Plugins

medium

medium

medium

high