request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For header

Summary

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

Timeline

1. Jun 16, 2015Public exploit on Exploit-DB

   EDB-41689

2. Jul 26, 2015, 10:00 PM UTCCVE published
3. Aug 6, 2024, 5:39 AM UTCRecord last updated
4. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• n/a n/a

  Version range not reported

• web-consoleRubyGems

  fixed in 2.1.3

References 13