漏洞描述
Specially crafted "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
seclists.orghttps://seclists.org/oss-sec/2021/q4/att-160/7-0-host-authorzation-open-redirect.patch↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-44528↗github.comhttps://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815↗www.debian.orghttps://www.debian.org/security/2023/dsa-5372↗security.netapp.comhttps://security.netapp.com/advisory/ntap-20240208-0003/↗