Description
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.
Remediation
References
Related Vulnerabilities
Ruby Other Vulnerability (CVE-2021-41817)
ownCloud Improper Privilege Management Vulnerability (CVE-2021-35946)
Joomla! Core 1.0.x Multiple Unspecified Vulnerabilities (1.0.0 - 1.0.9)
Perl Numeric Errors Vulnerability (CVE-2005-3962)
WordPress Plugin Gallery by BestWebSoft Cross-Site Scripting (4.2.1)