Open Redirect Vulnerability in Action Pack by Rails

CVE-2021-44528

What is CVE-2021-44528?

An open redirect vulnerability has been identified in Action Pack versions equal to or greater than 6.0.0. The issue arises from improper handling of the 'X-Forwarded-Host' header, enabling attackers to craft certain header values which can lead to unauthorized host redirections. This flaw allows users to be redirected to malicious websites, posing a significant risk as it can be exploited to facilitate phishing or distribute malware.

References