CVEs-PoC/2021/CVE-2021-22880.md

### [CVE-2021-22880](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-22880)
![](https://img.shields.io/static/v1?label=Product&message=https%3A%2F%2Fgithub.com%2Frails%2Frails&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=Fixed%20in%206.1.2.1%2C%206.0.3.5%2C%205.2.4.5%20&color=brightgreen)
![](https://img.shields.io/static/v1?label=Vulnerability&message=Denial%20of%20Service%20(CWE-400)&color=brightgreen)

### Description

The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS) vulnerability. Carefully crafted input can cause the input validation in the `money` type of the PostgreSQL adapter in Active Record to spend too much time in a regular expression, resulting in the potential for a DoS attack. This only impacts Rails applications that are using PostgreSQL along with money type columns that take user input.

### POC

#### Reference
No PoCs from references.

#### Github
- https://github.com/20142995/nuclei-templates
- https://github.com/ARPSyndicate/cvemon
- https://github.com/cyb3r-w0lf/nuclei-template-collection
- https://github.com/engn33r/awesome-redos-security
- https://github.com/halkichi0308/CVE-2021-22880