cve/2015/CVE-2015-3224.md

CVE-2015-3224

Description

request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

POC

Reference

No PoCs from references.

Github

• https://github.com/0x00-0x00/CVE-2015-3224
• https://github.com/0xEval/cve-2015-3224
• https://github.com/ACIC-Africa/metasploitable3
• https://github.com/ARPSyndicate/cvemon
• https://github.com/ARPSyndicate/kenzer-templates
• https://github.com/n000xy/CVE-2015-3224-
• https://github.com/redirected/tricks
• https://github.com/superfish9/pt
• https://github.com/uoanlab/vultest
• https://github.com/xda3m00n/CVE-2015-3224-