CVE-2015-3224
Web Console (Ruby gem) contains whitelisted_ips bypass
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Exploit likelihood
What each source reports
NVD Score used
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
- Record
CVE-2015-3224- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:P/A:N - Weakness
- CWE-284
- Updated
- 2026-11-02
CVE List No score
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
- Record
CVE-2015-3224- Updated
- 2026-11-02
EUVDEUVD-2017-0172 No score
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
- Record
EUVD-2017-0172- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-67j6-xv27-w6ww No score
Web Console (Ruby gem) contains whitelisted_ips bypass
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
- Record
GHSA-67j6-xv27-w6ww- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVGHSA-67j6-xv27-w6ww No score
Web Console (Ruby gem) contains whitelisted_ips bypass
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
- Record
GHSA-67j6-xv27-w6ww- Weakness
- CWE-284
- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:11356-1 No score
ruby2.7-rubygem-web-console-4.1.0-1.5 on GA media
These are all security issues fixed in the ruby2.7-rubygem-web-console-4.1.0-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:11356-1- Updated
- 2026-11-02
Show 4 moreShow less
OSVopenSUSE-SU-2024:13172-1 No score
ruby3.2-rubygem-web-console-4.2.0-1.9 on GA media
These are all security issues fixed in the ruby3.2-rubygem-web-console-4.2.0-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13172-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14179-1 No score
ruby3.3-rubygem-web-console-4.2.1-1.5 on GA media
These are all security issues fixed in the ruby3.3-rubygem-web-console-4.2.1-1.5 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14179-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15129-1 No score
ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media
These are all security issues fixed in the ruby3.4-rubygem-web-console-4.2.1-1.7 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15129-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2026:10367-1 No score
ruby4.0-rubygem-web-console-4.2.1-1.9 on GA media
These are all security issues fixed in the ruby4.0-rubygem-web-console-4.2.1-1.9 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10367-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
web-consoleRubyGems |
before 2.1.3 | 2.1.3 |
web-consoleRubyGems |
before 2.1.3, plus listed versions 0.1.00.2.00.3.00.4.01.0.0 Show 12 moreShow less1.0.11.0.21.0.31.0.42.0.02.0.0.beta12.0.0.beta22.0.0.beta32.0.0.beta42.1.02.1.12.1.2 |
2.1.3 |
ruby3.2-rubygem-web-consoleopenSUSE:Tumbleweed |
before 4.2.0-1.9 | 4.2.0-1.9 |
rubygem-web-consoleopenSUSE:Tumbleweed |
before 4.2.1-1.5 | 4.2.1-1.5 |
rubygem-web-consoleopenSUSE:Tumbleweed |
before 4.2.1-1.7 | 4.2.1-1.7 |
rubygem-web-consoleopenSUSE:Tumbleweed |
before 4.2.1-1.9 | 4.2.1-1.9 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit) | 2015-06-16 |
| Metasploit | Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution | 2015-06-16 |
| Nuclei | Ruby on Rails Web Console - Remote Code Execution | |
| PoC in GitHub | 0x00-0x00/CVE-2015-3224 | 2018-02-08 |
| PoC in GitHub | 0xEval/cve-2015-3224 | 2018-05-03 |
| PoC in GitHub | SQU4NCH/CVE-2015-3224 | 2026-01-09 |
| PoC in GitHub | Sic4rio/CVE-2015-3224 | 2025-07-06 |
| PoC in GitHub | n000xy/CVE-2015-3224- | 2021-02-27 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2015-3224 is a medium vulnerability (CVSS 4.3) in Rubyonrails Web Console, published July 26, 2015. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 48.8%, the 98th percentile. Fixed in web-console 2.1.3.
References
securityfocus.com/bid/75237
groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJ
openwall.com/lists/oss-security/2015/06/16/18
lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.html
github.com/rails/web-console/blob/master/CHANGELOG.markdown
nvd.nist.gov/vuln/detail/CVE-2015-3224