HTTP Header Vulnerability in Ruby on Rails

CVE-2023-28362

What is CVE-2023-28362?

The redirect_to method in Ruby on Rails permits user-supplied values that may include illegal characters in HTTP header values. This flaw can lead to issues where downstream services, which enforce adherence to RFC standards for HTTP response headers, may strip the assigned Location header. As a result, this vulnerability can expose applications to potential exploitation, impacting the integrity of redirect operations.

References