CVE-2021-22904: Ruby on Rails ActionPack DoS Vulnerability

CVE-2021-22904 Overview

A denial of service vulnerability exists in the Token Authentication logic within Action Controller, a core component of the Ruby on Rails framework. The vulnerability stems from a too permissive regular expression used during HTTP token authentication processing. Applications using authenticate_or_request_with_http_token or authenticate_with_http_token methods for request authentication are vulnerable to this attack.

Critical Impact

Attackers can craft malicious HTTP authentication tokens that trigger catastrophic backtracking in the permissive regular expression, causing severe CPU exhaustion and rendering the affected Rails application unresponsive.

Affected Products

• Ruby on Rails (actionpack gem) versions before 6.1.3.2
• Ruby on Rails (actionpack gem) versions before 6.0.3.7
• Ruby on Rails (actionpack gem) versions 5.2.x before 5.2.4.6 and 5.2.6

Discovery Timeline

• 2021-06-11 - CVE-2021-22904 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2021-22904

Vulnerability Analysis

This vulnerability is classified as a Regular Expression Denial of Service (ReDoS) attack, a specific form of algorithmic complexity attack (CWE-400: Uncontrolled Resource Consumption). The flaw resides in the token authentication mechanism within Action Controller, where a poorly crafted regular expression is used to parse HTTP Authorization headers containing token credentials.

When processing authentication tokens, the vulnerable code employs a regular expression pattern that exhibits exponential time complexity when matched against specially crafted input strings. This creates a scenario where an attacker can submit malicious tokens that cause the regex engine to enter a state of catastrophic backtracking, consuming excessive CPU cycles while attempting to match the pattern.

The vulnerability affects Rails applications that implement HTTP token-based authentication using the built-in authenticate_or_request_with_http_token or authenticate_with_http_token helper methods. These methods are commonly used to secure API endpoints and service-to-service communications.

Root Cause

The root cause is a too permissive regular expression pattern in the Action Controller token authentication logic. The regex lacks proper bounds and contains nested quantifiers that allow for exponential backtracking behavior. When the regex engine encounters input that can be partially matched in multiple ways, it attempts all possible combinations before failing, leading to severe performance degradation.

Attack Vector

The attack is network-accessible and requires no authentication or user interaction. An attacker can exploit this vulnerability by sending HTTP requests with malformed Authorization headers containing specially crafted token values. The crafted tokens are designed to trigger worst-case regex matching behavior.

The attack typically involves tokens containing repetitive character sequences that match multiple subpatterns within the permissive regex, forcing the engine into exponential backtracking. Since this occurs during the authentication phase, the attack can be executed before any application-level authentication checks take place.

Detection Methods for CVE-2021-22904

Indicators of Compromise

• Unusual spikes in CPU utilization on web application servers without corresponding increases in legitimate traffic
• HTTP requests with abnormally long or malformed Authorization headers containing repetitive character patterns
• Application response times degrading significantly during periods of seemingly normal request volumes
• Web server worker processes becoming unresponsive or timing out frequently

Detection Strategies

• Monitor for HTTP requests with Authorization headers exceeding normal length thresholds (e.g., >500 characters)
• Implement request timeout monitoring to detect regex processing delays in authentication middleware
• Deploy Web Application Firewall (WAF) rules to inspect and filter suspicious Authorization header patterns
• Enable Rails application logging to capture authentication method invocation times

Monitoring Recommendations

• Set up alerting for sustained CPU usage spikes across Rails application workers
• Monitor request queue depth and worker availability metrics
• Track authentication endpoint response latencies as key performance indicators
• Review server logs for patterns of requests with unusual Authorization header content

How to Mitigate CVE-2021-22904

Immediate Actions Required

• Upgrade the actionpack gem to patched versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, or 5.2.6 immediately
• Identify all Rails applications using authenticate_or_request_with_http_token or authenticate_with_http_token methods
• Implement request rate limiting at the load balancer or reverse proxy level to reduce DoS impact
• Consider deploying a WAF with rules to filter malformed Authorization headers while patches are applied

Patch Information

Ruby on Rails has released patched versions addressing this vulnerability. Organizations should upgrade to the following versions:

• Rails 6.1.x: Upgrade to 6.1.3.2 or later
• Rails 6.0.x: Upgrade to 6.0.3.7 or later
• Rails 5.2.x: Upgrade to 5.2.4.6 or 5.2.6 or later

For detailed patch information and upgrade guidance, refer to the Ruby on Rails Security Advisory.

Workarounds

• Implement custom input validation to limit Authorization header length before it reaches the Rails authentication layer
• Deploy a reverse proxy (nginx, HAProxy) with header size limits to reject oversized Authorization headers
• Temporarily disable HTTP token authentication and switch to alternative authentication mechanisms if feasible
• Apply network-level rate limiting to authentication endpoints to mitigate the impact of DoS attempts

# Nginx configuration to limit Authorization header size
# Add to server or location block
large_client_header_buffers 4 8k;

# Optional: Add explicit header validation
if ($http_authorization ~* "^Token\s+.{500,}") {
    return 400;
}