Ruby on Rails Web Console - Remote Code Execution

mediumseverity

4.3CVSS score

48.8%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb.

Impact

Remote code execution can lead to unauthorized access, data breaches, and complete compromise of the affected system.

Fix

Upgrade to a patched version of Ruby on Rails or disable the Web Console feature.

How to confirm it

Send: GET {{BaseURL}}/{{randstr}}
Positive when: contains "Rails.root:" and "Action Controller: Exception caught" AND contains in response "X-Web-Console-Session-Id" or "data-remote-path=" or "data-session-id="

Run it with nuclei: nuclei -id CVE-2015-3224 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-3224

info:
  name: Ruby on Rails Web Console - Remote Code Execution
  author: pdteam
  severity: medium
  description: Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb.
  impact: |
    Remote code execution can lead to unauthorized access, data breaches, and complete compromise of the affected system.
  remediation: |
    Upgrade to a patched version of Ruby on Rails or disable the Web Console feature.
  reference:
    - https://www.metahackers.pro/rails-web-console-v2-whitelist-bypass-code-exec/
    - https://www.jomar.fr/posts/2022/basic_recon_to_rce_ii/
    - https://hackerone.com/reports/44513
    - https://nvd.nist.gov/vuln/detail/CVE-2015-3224
    - http://lists.fedoraproject.org/pipermail/package-announce/2015-June/160881.html
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:M/Au:N/C:N/I:P/A:N
    cvss-score: 4.3
    cve-id: CVE-2015-3224
    cwe-id: CWE-284
    epss-score: 0.48842
    epss-percentile: 0.98887
    cpe: cpe:2.3:a:rubyonrails:web_console:*:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: rubyonrails
    product: web_console
  tags: cve2015,cve,ruby,hackerone,rce,rails,intrusive,rubyonrails,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/{{randstr}}"

    headers:
      X-Forwarded-For: "::1"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "Rails.root:"
          - "Action Controller: Exception caught"
        condition: and

      - type: word
        part: response
        words:
          - X-Web-Console-Session-Id
          - data-remote-path=
          - data-session-id=
        case-insensitive: true
        condition: or

References

Use this check only on systems you are authorised to test. Where the data comes from