Signature Detail
This site is deprecated. Please CLICK HERE for latest updates
Short Name |
HTTP:CTS:RUBY-RAILS-RCE |
|---|---|
Severity |
Minor |
Recommended |
No |
Category |
HTTP |
Keywords |
Ruby on Rails Web Console CVE-2015-3224 Remote Code Execution |
Release Date |
2020/04/07 |
Update Number |
3269 |
Supported Platforms |
srx-12.1+, srx-branch-12.1+, vsrx-12.1+, vsrx3bsd-18.2+ |
HTTP: Ruby on Rails Web Console CVE-2015-3224 Remote Code Execution
This signature detects attempts to exploit a known vulnerability against Ruby on Rails. A successful attack can lead to arbitrary code execution.
Extended Description
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Affected Products
- Rubyonrails web_console 2.1.2
References
- BugTraq: 75237
- CVE: CVE-2015-3224