CVSS: 7.5EPSS: 0%CPEs: 4EXPL: 1CVE-2021-22904 – rails: Possible DoS Vulnerability in Action Controller Token Authentication
https://notcve.org/view.php?id=CVE-2021-22904
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication. El actionpack ruby gem versiones anteriores a 6.1.3.2, 6.0.3.7, 5.2.4.6 y 5.2.6, sufre una posible vulnerabilidad de denegación de servicio en la lógica de autenticación de tokens en Action Controller debido a una expresión regular demasiado permisiva. El código afectado usa las funciones "authenticate_or_request_with_http_token" o "authenticate_with_http_token" para la autenticación de peticiones A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller. • https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869 https://hackerone.com/reports/1101125 https://security.netapp.com/advisory/ntap-20210805-0009 https://access.redhat.com/security/cve/CVE-2021-22904 https://bugzilla.redhat.com/show_bug.cgi?id=1961379 • CWE-400: Uncontrolled Resource Consumption •
CVSS: 7.5EPSS: 1%CPEs: 5EXPL: 1CVE-2021-22885 – rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack
https://notcve.org/view.php?id=CVE-2021-22885
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input. Una posible vulnerabilidad de divulgación de información y ejecución de método no intecional en Action Pack versiones posteriores a 2.0.0 e incluyéndola, cuando se usa la ayuda "redirect_to" o "polymorphic_url" con la entrada de un usuario no confiable A flaw was found in rubygem-actionpack. Information disclosure or unintended method execution is possible when using the `redirect_to` or `polymorphic_url` helper with untrusted user input. The highest threat from this vulnerability is to data confidentiality. • https://hackerone.com/reports/1106652 https://security.netapp.com/advisory/ntap-20210805-0009 https://www.debian.org/security/2021/dsa-4929 https://access.redhat.com/security/cve/CVE-2021-22885 https://bugzilla.redhat.com/show_bug.cgi?id=1957441 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor CWE-209: Generation of Error Message Containing Sensitive Information •
CVSS: 6.1EPSS: 0%CPEs: 3EXPL: 2CVE-2021-22881
https://notcve.org/view.php?id=CVE-2021-22881
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted `Host` headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. Impacted applications will have allowed hosts with a leading dot. When an allowed host contains a leading dot, a specially crafted `Host` header can be used to redirect to a malicious website. El middleware de Autorización de Host en Action Pack versiones anteriores a 6.1.2.1, 6.0.3.5 sufre una vulnerabilidad de redireccionamiento abierto. • http://www.openwall.com/lists/oss-security/2021/05/05/2 http://www.openwall.com/lists/oss-security/2021/08/20/1 http://www.openwall.com/lists/oss-security/2021/12/14/5 https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130 https://hackerone.com/reports/1047447 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedorap • CWE-601: URL Redirection to Untrusted Site ('Open Redirect') •
CVSS: 7.5EPSS: 0%CPEs: 5EXPL: 2CVE-2021-22880
https://notcve.org/view.php?id=CVE-2021-22880
The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input. El adaptador PostgreSQL en Active Record versiones anteriores a 6.1.2.1, 6.0.3.5, 5.2.4.5, sufre una vulnerabilidad de denegación de servicio de expresión regular (REDoS). Una entrada cuidadosamente diseñada puede causar que la comprobación de la entrada en el tipo "money" del adaptador de PostgreSQL en Active Record pase demasiado tiempo en una expresión regular, resultando en la posibilidad de un ataque DoS. • https://github.com/halkichi0308/CVE-2021-22880 https://discuss.rubyonrails.org/t/cve-2021-22880-possible-dos-vulnerability-in-active-record-postgresql-adapter/77129 https://hackerone.com/reports/1023899 https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/MO5OJ3F4ZL3UXVLJO6ECANRVZBNRS2IH https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3 https://security.netapp.com/advisory/ntap-20210805-0009 https://www.debian.org/ • CWE-400: Uncontrolled Resource Consumption •
CVSS: 6.1EPSS: 0%CPEs: 1EXPL: 1CVE-2020-8264
https://notcve.org/view.php?id=CVE-2020-8264
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware. En actionpack gem versiones posteriores a 6.0.0 incluyéndola, se presenta una posible vulnerabilidad de tipo XSS cuando una aplicación se ejecuta en modo development permitiendo a un atacante enviar o insertar (en otra página) una URL especialmente diseñada que puede permitir al atacante ejecutar JavaScript en el contexto de la aplicación local. Esta vulnerabilidad se encuentra en el middleware de Excepciones Accionables • https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ https://hackerone.com/reports/904059 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •