CVE-2011-3187
Ruby on Rails 3.0.5 - Improper Input Validation in X-Forwarded-For Header
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2011-3187. PoCs published by Jimmy Bandit.
AI-analyzed exploit summary This exploit demonstrates HTTP header injection in Ruby on Rails 3.0.5 by manipulating the 'X-Forwarded-For' header to inject arbitrary data, including spoofed IPs and binary payloads, affecting log files and potentially enabling date back attacks or DoS.
Description
The to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Exploits (1)
This exploit demonstrates HTTP header injection in Ruby on Rails 3.0.5 by manipulating the 'X-Forwarded-For' header to inject arbitrary data, including spoofed IPs and binary payloads, affecting log files and potentially enabling date back attacks or DoS.