CVE-2015-3224 Web Console (Ruby gem) contains whitelisted_ips bypass
Attackers can bypass IP whitelisting in Web Console by spoofing X-Forwarded-For headers, gaining unauthorized access to the debugging console.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-3224?
CVE-2015-3224 is a medium-severity vulnerability in n/a, published on 26 Jul 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Weakness: CWE-284
Which versions are affected by CVE-2015-3224?
2 open source packages ship an affected version, including web-console. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
web-console RubyGems | All versions | 2.1.3 |
web-console RubyGems | All versions | 2.1.3 |
Linux distribution packages (4)
ruby3.2-rubygem-web-console openSUSE:Tumbleweed | All versions | 4.2.0-1.9 |
rubygem-web-console openSUSE:Tumbleweed | All versions | 4.2.1-1.5 |
rubygem-web-console openSUSE:Tumbleweed | All versions | 4.2.1-1.7 |
rubygem-web-console openSUSE:Tumbleweed | All versions | 4.2.1-1.9 |
Products include Rubyonrails Web Console.
How do I fix CVE-2015-3224?
Upgrade web-console to 2.1.3 or later.
Is CVE-2015-3224 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-3224 exists.
Public exploit code: 1 Metasploit module, 1 Exploit-DB entry, 1 Nuclei template and 5 proofs of concept on GitHub.
Sources
Also known as GHSA-67j6-xv27-w6ww, openSUSE-SU-2024:11356-1, openSUSE-SU-2024:13172-1, openSUSE-SU-2024:14179-1, openSUSE-SU-2025:15129-1, openSUSE-SU-2026:10367-1.