CVE-2021-22904
📋 TL;DR
This vulnerability in Ruby on Rails' Actionpack gem allows attackers to cause denial of service through token authentication. A too-permissive regular expression in the HTTP token authentication logic can be exploited to cause excessive CPU consumption. Applications using authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication are affected.
💻 Affected Systems
- Ruby on Rails Actionpack gem
📦 What is this software?
Rails by Rubyonrails
Rails by Rubyonrails
Rails by Rubyonrails
Rails by Rubyonrails
⚠️ Risk & Real-World Impact
Worst Case
Complete service unavailability due to CPU exhaustion, making the application inaccessible to legitimate users.
Likely Case
Degraded performance and intermittent service disruptions during attack periods.
If Mitigated
Minimal impact with proper rate limiting and monitoring in place.
🎯 Exploit Status
Exploitation requires sending specially crafted HTTP requests with malformed authentication tokens.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Actionpack 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 or higher
Vendor Advisory: https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
Restart Required: Yes
Instructions:
1. Update Gemfile to require patched Actionpack version. 2. Run 'bundle update actionpack'. 3. Restart the Rails application server.
🔧 Temporary Workarounds
Implement rate limiting
allAdd request rate limiting to authentication endpoints to mitigate DoS impact
Disable token authentication
allTemporarily disable or replace token authentication with alternative methods
🧯 If You Can't Patch
- Implement Web Application Firewall (WAF) rules to block malformed authentication headers
- Deploy additional monitoring and alerting for CPU spikes on authentication endpoints
🔍 How to Verify
Check if Vulnerable:
Check Gemfile.lock for actionpack version and verify if using vulnerable token authentication methodsCheck Version:
bundle show actionpackVerify Fix Applied:
Verify actionpack version is >= 6.1.3.2, >= 6.0.3.7, >= 5.2.4.6, or >= 5.2.6 in Gemfile.lock📡 Detection & Monitoring
Log Indicators:
- High CPU usage on authentication endpoints
- Multiple failed authentication attempts with malformed tokens
- Slow response times on authenticated routes
Network Indicators:
- Unusual patterns of HTTP requests to authentication endpoints
- Requests with malformed Authorization headers
SIEM Query:
source="rails.log" AND ("authenticate_with_http_token" OR "authenticate_or_request_with_http_token") AND duration > 5000ms🔗 References
- https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
- https://hackerone.com/reports/1101125
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
- https://hackerone.com/reports/1101125
- https://security.netapp.com/advisory/ntap-20210805-0009/
