{"id":"CVE-2015-3224","aliases":["EUVD-2017-0172","GHSA-67j6-xv27-w6ww","openSUSE-SU-2024:11356-1","openSUSE-SU-2024:13172-1","openSUSE-SU-2024:14179-1","openSUSE-SU-2025:15129-1","openSUSE-SU-2026:10367-1"],"status":"published","title":"Web Console (Ruby gem) contains whitelisted_ips bypass","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","severity":{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.48842,"percentile":0.98885,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-284"],"published":"2015-07-26T22:00:00Z","modified":"2026-06-17T00:25:34Z","exploits":[{"source":"exploitdb","id":"EDB-41689","title":"Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit)","type":"remote","platform":"multiple","date":"2015-06-16","verified":true,"url":"https://www.exploit-db.com/exploits/41689"},{"source":"metasploit","id":"exploit/multi/http/rails_web_console_v2_code_exec","title":"Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution","type":"exploit","platform":"Ruby","date":"2015-06-16","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/rails_web_console_v2_code_exec"},{"source":"nuclei","id":"CVE-2015-3224","title":"Ruby on Rails Web Console - Remote Code Execution","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3224.yaml"},{"source":"pocgithub","id":"0x00-0x00/CVE-2015-3224","title":"0x00-0x00/CVE-2015-3224","date":"2018-02-08","url":"https://github.com/0x00-0x00/CVE-2015-3224"},{"source":"pocgithub","id":"0xEval/cve-2015-3224","title":"0xEval/cve-2015-3224","date":"2018-05-03","url":"https://github.com/0xEval/cve-2015-3224"},{"source":"pocgithub","id":"SQU4NCH/CVE-2015-3224","title":"SQU4NCH/CVE-2015-3224","date":"2026-01-09","url":"https://github.com/SQU4NCH/CVE-2015-3224"},{"source":"pocgithub","id":"Sic4rio/CVE-2015-3224","title":"Sic4rio/CVE-2015-3224","date":"2025-07-06","url":"https://github.com/Sic4rio/CVE-2015-3224"},{"source":"pocgithub","id":"n000xy/CVE-2015-3224-","title":"n000xy/CVE-2015-3224-","date":"2021-02-27","url":"https://github.com/n000xy/CVE-2015-3224-"}],"fixes":[{"ecosystem":"RubyGems","package":"web-console","fixed_in":["2.1.3"],"sources":["ghsa","osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-web-console","fixed_in":["4.2.0-1.9"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-web-console","fixed_in":["4.2.1-1.5","4.2.1-1.7","4.2.1-1.9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}]},{"source":"osv","ecosystem":"RubyGems","package":"web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.1.3"}]}],"versions":["0.1.0","0.2.0","0.3.0","0.4.0","1.0.0","1.0.1","1.0.2","1.0.3","1.0.4","2.0.0","2.0.0.beta1","2.0.0.beta2","2.0.0.beta3","2.0.0.beta4","2.1.0","2.1.1","2.1.2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.0-1.9"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1.5"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1.7"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-web-console","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.1-1.9"}]}]}],"products":[{"vendor":"rubyonrails","product":"web_console"}],"references":[{"url":"http://www.securityfocus.com/bid/75237","tags":["vdb-entry","x_refsource_BID","x_transferred"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/lzmz9_ijUFw/HBMPi4zp5NAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory"]},{"url":"http://openwall.com/lists/oss-security/2015/06/16/18","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://github.com/rails/web-console/blob/master/CHANGELOG.markdown","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3224","tags":["advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/web-console/CVE-2015-3224.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/ruby-security-ann/lzmz9_ijUFw","tags":["web"]},{"url":"https://github.com/advisories/GHSA-67j6-xv27-w6ww"},{"url":"https://github.com/rails/web-console","tags":["package"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3224","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/5A4G5B5ZDCF4U3MWFQWU23AD4UPM7TYX/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2015-3224","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T05:39:32.095Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2017-0172","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","status":"published","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T05:39:32Z","updated_at":"2026-11-03T02:22:08.642556Z"}],"ghsa":[{"id":"GHSA-67j6-xv27-w6ww","title":"Web Console (Ruby gem) contains whitelisted_ips bypass","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2023-08-28T13:46:20Z","cwes":["CWE-284"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2015-3224","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","status":"published","published":"2015-07-26T22:59:03.023Z","modified":"2026-06-17T00:25:34.343Z","cvss":[{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-284"],"updated_at":"2026-11-02T14:03:07.96297Z"}],"osv":[{"id":"GHSA-67j6-xv27-w6ww","title":"Web Console (Ruby gem) contains whitelisted_ips bypass","description":"request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.","status":"published","published":"2017-10-24T18:33:36Z","modified":"2024-12-03T05:58:53.260647Z","cwes":["CWE-284"],"updated_at":"2026-11-02T15:46:39.266402Z"},{"id":"openSUSE-SU-2024:11356-1","title":"ruby2.7-rubygem-web-console-4.1.0-1.5 on GA media","description":"These are all security issues fixed in the ruby2.7-rubygem-web-console-4.1.0-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:22:51.277688Z","updated_at":"2026-11-02T16:58:35.195147Z"},{"id":"openSUSE-SU-2024:13172-1","title":"ruby3.2-rubygem-web-console-4.2.0-1.9 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-web-console-4.2.0-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:24:19.630446Z","updated_at":"2026-11-02T16:58:36.025801Z"},{"id":"openSUSE-SU-2024:14179-1","title":"ruby3.3-rubygem-web-console-4.2.1-1.5 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-web-console-4.2.1-1.5 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-12T00:00:00Z","modified":"2026-02-04T04:08:08.395687Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15129-1","title":"ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-web-console-4.2.1-1.7 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:59:15.392752Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2026:10367-1","title":"ruby4.0-rubygem-web-console-4.2.1-1.9 on GA media","description":"These are all security issues fixed in the ruby4.0-rubygem-web-console-4.2.1-1.9 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-03-13T00:00:00Z","modified":"2026-03-14T08:18:00.999022Z","updated_at":"2026-11-02T16:58:38.415593Z"}]}}