CVE-2015-3224: Web Console IP whitelist bypass via X-Forwarded-For header

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 20 September 2026. Confidence: medium.

high priorityThe flaw allows bypass of an access control protecting an interactive Rails console, and EPSS is high at the 98.7th percentile despite the medium CVSS 2.0 score.

What it is

Web Console before 2.1.3, used with Ruby on Rails 3.x and 4.x, trusts the X-Forwarded-For header when determining a client's IP address. This lets a remote attacker spoof that header and bypass the whitelisted_ips access control that is meant to keep the console reachable only from trusted addresses.

Impact

An attacker who can reach the console endpoint gains access to the Web Console despite the IP whitelist, exposing an interactive Rails execution environment. The CVSS 2.0 vector shows partial integrity impact only, with no confidentiality or availability impact recorded.

Attack surface

Reached over the network against the Web Console endpoint; the CVSS vector AV:N/AC:M/Au:N indicates no authentication is required, though the crafted request must satisfy the medium complexity condition. No user interaction is indicated.

Exploitation

Not listed in CISA KEV and no exploit tags appear in the references, but EPSS is 0.44708 (98.7th percentile), indicating a high modeled likelihood of exploitation activity.

What to do

• Upgrade Web Console to 2.1.3 or later, which is the fixed release named in the advisory.
• If upgrade is not immediately possible, restrict network access to the console endpoint at the proxy or firewall layer rather than relying on whitelisted_ips.
• Strip or normalize client-supplied X-Forwarded-For headers at the reverse proxy so the application cannot be tricked by spoofed values.
• Disable Web Console in production environments where it is not required.

Detection

• Review Web Console access logs for requests whose X-Forwarded-For value does not match the actual source address.
• Alert on console requests originating from addresses outside the intended whitelist.
• Monitor for anomalous or unexpected console sessions, especially from external or untrusted networks.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.