CVE-2021-22881: Rails Action Pack Host Authorization middleware open redirect

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityThe flaw is remotely reachable without authentication and has very high EPSS with public exploit references, though it requires user interaction and a specific leading-dot configuration.

What it is

The Host Authorization middleware in Action Pack before 6.1.2.1 and 6.0.3.5 mishandles specially crafted Host headers when an allowed host entry has a leading dot, allowing an open redirect to an attacker-controlled site. It matters because the redirect originates from a trusted application domain, which aids phishing and credential theft. Only applications configured with leading-dot allowed hosts are impacted.

Impact

An attacker can cause the application to redirect a victim to a malicious website, enabling phishing, credential harvesting or malware delivery under the cover of a trusted domain. The CVSS vector shows limited confidentiality and integrity impact with no availability impact.

Attack surface

Reachable over the network via a crafted Host header on requests to the affected middleware; no authentication is required, but the victim must follow the redirect, so user interaction is needed. Exploitation requires the application to have an allowed host entry with a leading dot.

Exploitation

Not listed in CISA KEV, but EPSS is very high (0.873 probability, 99.7th percentile) and multiple references are tagged Exploit, including a HackerOne report and an oss-security post, indicating public exploit detail exists. No ransomware usage is documented.

What to do

• Upgrade Action Pack to 6.1.2.1 or 6.0.3.5 (or later) as the primary fix.
• Remove leading dots from allowed host entries in the Host Authorization configuration where possible.
• Review and tighten the allowed hosts list so only exact, intended hostnames are accepted.
• Apply the Fedora package updates referenced in the advisory for Rails packages.
• Where patching is delayed, add a reverse proxy or WAF rule that rejects malformed or unexpected Host headers.

Detection

• Monitor web and proxy logs for requests with unusual or attacker-controlled Host header values, especially those matching allowed hosts with leading dots.
• Alert on outbound redirect responses (3xx) whose Location header points to domains outside the expected allowlist.
• Correlate spikes in redirect responses with Host header anomalies from the same source.
• Review application configuration for allowed host entries containing leading dots as an exposure indicator.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.