Ruby on Rails · Report #44513
RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1
Summary
IP whitelist bypass in Web Console
There is a remote code execution vulnerability in Web Console. This vulnerability has been assigned the CVE identifier CVE-2015-3224.
Versions Affected: All Not affected: Environments inaccessible from remote IPs, or without Web Console enabled Fixed Versions: 2.1.3
Impact
Specially crafted remote requests can spoof their origin, bypassing the IP whitelist, in any environment where Web Console is enabled (development and test, by default).
Users whose application is only accessible from localhost (as is the default behaviour in Rails 4.2) are not affected, unless a local proxy is involved.
All affected users should either upgrade or use one of the work arounds immediately.
Releases
The 2.1.3 release is available at the normal locations.
Workarounds
To work around this issue, turn off web-console in all environments, by removing/commenting it from the application's Gemfile.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 2-1-ip-whitelist.patch - Patch for 2.1 series
Please note that only the 2.1.x series is supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible.
Credits
This vulnerability was reported by both joernchen of Phenoelit and Ben Murphy. Thanks to each of them for reporting the issue to us and verifying the fix.
How it was found
With the release of Ruby on Rails 4.2 the so called Web Console was introduced.
As the Web Console documentation states: Web Console is built explicitly for Rails 4.
By default the Web Console is available in the Rails Development Environment and allows only the IPs 127.0.0.1 and ::1 to access the console in order to evaluate arbitrary Ruby statements for the purpose of debugging.
However with Rails Versions 4.1 and 4.0 the Web Console built in IP whitelist is bypassable.
This is due to the fact that Web Console parses the request.remote_ip to check if the IP is whitelisted with the Ruby class IPAddr. The Rails stack prior to 4.2 when calculating request.remote_ip uses these regular expressions to strip out trusted Proxies from the HTTP Headers X-Forwarded-For and Client-IP.
Due to this parser differential an attacker might bypass the Web Console IP whitelist by supplying a HTTP header value of:
X-Forwarded-For: 0000::1
This IPv6 address in the given notation would bypass the TRUSTED_PROXIES entry ^::1$ but match the IPAddr value of ::1 within Web Console.
As the Web Console is intended for debugging in the Development Environment this will most likely not affect Production setups, unless Web Console is explicitly enabled. But gaining RCE on Developer laptops might be fun as well ;).
I've already sent a description of this to the Rails Security Team via mail, but I've been asked to submit here again.
The easiest mitigation of this issue would be to disallow execution of Web Console within Rails < 4.2.