CVE-2015-3224 PoC — Ruby on Rails Web Console 代码注入漏洞

Source

https://github.com/n000xy/CVE-2015-3224-

Associated Vulnerability

Title: Ruby on Rails Web Console 代码注入漏洞 (CVE-2015-3224)
Description:request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request.

Description

CVE-2015-3224

Readme

# CVE-2015-3224-
just a stupid version for CVE-2015-3224, for web console.
need to setup web server for pty.py

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →