Denial of Service Vulnerability in ActionPack Ruby Gem by Ruby on Rails
CVE-2021-22904

7.5HIGH

Key Information:

Vendor

Rubyonrails

Status
Https://github.com/rails/rails
Vendor
CVE Published:
11 June 2021

What is CVE-2021-22904?

A vulnerability exists in the ActionPack Ruby gem that could allow an attacker to exploit a weakness in the Token Authentication logic within Action Controller. This vulnerability arises from an overly permissive regular expression utilized in authentication methods such as authenticate_or_request_with_http_token and authenticate_with_http_token. Exploiting this flaw could potentially lead to a denial of service, undermining the application’s availability. It is recommended that users upgrade to the latest secure versions to mitigate any risk.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

https://github.com/rails/rails Fixed in 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6

References

https://hackerone.com/reports/1101125
x_refsource_MISC
https://discuss.rubyonrails.org/t/cve-2021-22904-possible...
x_refsource_MISC
https://security.netapp.com/advisory/ntap-20210805-0009/
x_refsource_CONFIRM

EPSS Score

8% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

JSON
.