CVE-2021-22904
rails: Possible DoS Vulnerability in Action Controller Token Authentication
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.
El actionpack ruby gem versiones anteriores a 6.1.3.2, 6.0.3.7, 5.2.4.6 y 5.2.6, sufre una posible vulnerabilidad de denegación de servicio en la lógica de autenticación de tokens en Action Controller debido a una expresión regular demasiado permisiva. El código afectado usa las funciones "authenticate_or_request_with_http_token" o "authenticate_with_http_token" para la autenticación de peticiones
A flaw was found in RubyGem Actionpack which is framework for handling and responding to web requests in Rails. A possible DoS vulnerability was found in the Token Authentication logic in Action Controller.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2021-01-06 CVE Reserved
- 2021-06-11 CVE Published
- 2024-02-25 EPSS Updated
- 2024-08-03 CVE Updated
- 2024-08-03 First Exploit
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-400: Uncontrolled Resource Consumption
CAPEC
References (4)
| URL | Tag | Source |
|---|---|---|
| https://security.netapp.com/advisory/ntap-20210805-0009 | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869 | 2024-08-03 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| https://access.redhat.com/security/cve/CVE-2021-22904 | 2021-11-16 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1961379 | 2021-11-16 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | < 5.2.4.6 Search vendor "Rubyonrails" for product "Rails" and version " < 5.2.4.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 5.2.5 < 5.2.6 Search vendor "Rubyonrails" for product "Rails" and version " >= 5.2.5 < 5.2.6" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.0.0 < 6.0.3.7 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.0.0 < 6.0.3.7" | - |
Affected
| ||||||
| Rubyonrails Search vendor "Rubyonrails" | Rails Search vendor "Rubyonrails" for product "Rails" | >= 6.1.0 < 6.1.3.2 Search vendor "Rubyonrails" for product "Rails" and version " >= 6.1.0 < 6.1.3.2" | - |
Affected
| ||||||