CVE-2021-22881 PoC — Rails Action Pack 输入验证错误漏洞

Title:Rails Action Pack 输入验证错误漏洞 (CVE-2021-22881)
Description:The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website.

Ruby on Rails action pack before 6.1.2.1, 6.0.3.5 contains an open redirect caused by special crafted Host headers in combination with allowed host formats, letting attackers redirect users to malicious websites, exploit requires attacker to control Host headers.

 id: CVE-2021-22881

info:
  name: Ruby on Rails - Open Redirect via Host Header Injection
  author: 

...