request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict
    the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to
    bypass the whitelisted_ips protection mechanism via a crafted request. (CVE-2015-3224)

Security fix for CVE-2015-3224. Please note that since the security fix was not really backportable, I opted in for rebase.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

ID	Name	Product	Family	Severity
422266	SCA: security update for web-console (GHSA-67j6-xv27-w6ww)	Tenable Cloud Security	SCA Checks	medium
422266	SCA: security update for web-console (GHSA-67j6-xv27-w6ww)	Tenable Self-Hosted Container Security	SCA Checks	medium
84452	Fedora 22 : rubygem-web-console-2.1.3-1.fc22 (2015-10128)	Nessus	Fedora Local Security Checks	medium
84255	FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3224

medium

Tenable Plugins

medium

medium

medium

medium