Description
request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | ruby3.2-rubygem-web-console | 4.2.0-1.9 | openSUSE-SU-2024:13172-1 |
| openSUSE Tumbleweed | rubygem-web-console | 4.2.1-1.5 | openSUSE-SU-2026:10367-1, openSUSE-SU-2025:15129-1, openSUSE-SU-2024:14179-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution
exploit/multi/http/rails_web_console_v2_code_exec
Exploit-DB 1
- Ruby on Rails 4.0.x/4.1.x/4.2.x (Web Console v2) - Whitelist Bypass Code Execution (Metasploit) EDB-41689 · remote · Jun 16, 2015 · verified
GitHub 5 repositories
-
0xEval/cve-2015-3224 ★ 6 · May 3, 2018
Ruby on Rails Web Console (v2) Whitelist Bypass Code Execution implementation in Python
-
0x00-0x00/CVE-2015-3224 ★ 2 · Feb 8, 2018
Modification of Metasploit module for RCE in Ruby-On-Rails Console CVE-2015-3224
-
SQU4NCH/CVE-2015-3224 ★ 1 · Jan 9, 2026
CVE-2015-3224 Exploit - Rails Web Console RCE
-
Sic4rio/CVE-2015-3224 ★ 0 · Jul 6, 2025
Ruby on Rails Web Console Exploit (CVE-2015-3224)
-
n000xy/CVE-2015-3224- ★ 0 · Feb 27, 2021
CVE-2015-3224
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Ruby on Rails Web Console - Remote Code Execution http/cves/2015/CVE-2015-3224.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | web-console | < 2.1.3 | 2.1.3 | GHSA-67j6-xv27-w6ww |
Advisories 5
- openSUSE-SU-2026:10367-1 ruby4.0-rubygem-web-console-4.2.1-1.9 on GA media SUSE / openSUSE Security Updates · Mar 14, 2026
- openSUSE-SU-2024:13172-1 ruby3.2-rubygem-web-console-4.2.0-1.9 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2024:14179-1 ruby3.3-rubygem-web-console-4.2.1-1.5 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- openSUSE-SU-2025:15129-1 ruby3.4-rubygem-web-console-4.2.1-1.7 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2023-1042 Ruby: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen BSI CERT-Bund (WID) · Jul 6, 2025
References
- 75237 vdb-entry
- [rubyonrails-security] 20150616 [CVE-2015-3224] IP whitelist bypass in Web Console mailing-list
- [oss-security] 20150616 [CVE-2015-3224] IP whitelist bypass in Web Console mailing-list
- FEDORA-2015-10128 vendor-advisory
- https://github.com/rails/web-console/blob/master/CHANGELOG.markdown