# The Host Authorization middleware in Action Pack is vulnerable to crafted X-Forwarded-Host values

Rails Host Authorization middleware failed to downcase X-Forwarded-Host, so mixed-case hosts bypassed the allowlist and enabled open redirects.

- Payout: hidden
- Severity: medium
- Program: Internet Bug Bounty
- Found by: mshtawythug
- Disclosed: 2021-11-18
- CVE: CVE-2021-22942
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/1374512
- Library page: https://bugbountylibrary.com/r/h1%3A1374512
- Tags: area:web domain:web impact:integrity kind:bounty platform:hackerone sev:medium tech:ruby technique:incomplete-fix technique:source-review vuln:auth-bypass vuln:open-redirect

**Target:** Host Authorization middleware in Action Pack
**Root cause:** forwarded_host is matched against valid_host without downcasing, so mixed-case hosts return nil, and the nil? check in the permission condition treats it as allowed.
**Steps:**
1. Configure a controller that calls `redirect_to('/')`.
2. Send `curl 'http://localhost:3000/tests' -H 'X-Forwarded-Host: Evil.com'`.
3. Observe redirect to `http://Evil.com/` instead of the blocked-host page.
4. Repeat with `X-Forwarded-Host: EVIL.COM` to confirm case bypass.
**How found:** Follow-up to CVE-2021-22881: reading the host_authorization.rb code, noticed forwarded_host lacked a downcase after to_s, unlike origin_host, and that nil forwarded_host satisfies the nil? branch of the permission check.
**Exploitation:** Attacker sends a request with a mixed-case X-Forwarded-Host; the middleware's nil forwarded_host passes the allowlist check, and the app redirects the victim to the attacker-controlled host.
**Insight:** When a security check compares a parsed value against an allowlist, look for asymmetric normalization between the two inputs (here origin_host downcased, forwarded_host not) and for nil-returning parse failures that satisfy a `nil? ||` short-circuit.