From 287ab7927774c4c49c2c96a70e89f0d4d5280ce3 Mon Sep 17 00:00:00 2001
From: MostInterestingBotInTheWorld
 <98333686+MostInterestingBotInTheWorld@users.noreply.github.com>
Date: Tue, 10 May 2022 11:16:42 -0400
Subject: [PATCH] Enhancement: cves/2015/CVE-2015-3224.yaml by mp

---
 cves/2015/CVE-2015-3224.yaml | 6 ++++--
 1 file changed, 4 insertions(+), 2 deletions(-)

diff --git a/cves/2015/CVE-2015-3224.yaml b/cves/2015/CVE-2015-3224.yaml
index 94da3bf928..c8fd037c9d 100644
--- a/cves/2015/CVE-2015-3224.yaml
+++ b/cves/2015/CVE-2015-3224.yaml
@@ -4,15 +4,15 @@ info:
   name: Ruby on Rails Web Console - Remote Code Execution
   author: pdteam
   severity: critical
+  description: "Ruby on Rails Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request to request.rb."
   reference:
     - https://www.metahackers.pro/rails-web-console-v2-whitelist-bypass-code-exec/
     - https://www.jomar.fr/posts/2022/basic_recon_to_rce_ii/
     - https://hackerone.com/reports/44513
     - https://nvd.nist.gov/vuln/detail/CVE-2015-3224
-  tags: cve,cve2015,rce,rails,ruby
-  description: "request.rb in Web Console before 2.1.3, as used with Ruby on Rails 3.x and 4.x, does not properly restrict the use of X-Forwarded-For headers in determining a client's IP address, which allows remote attackers to bypass the whitelisted_ips protection mechanism via a crafted request."
   classification:
     cve-id: CVE-2015-3224
+  tags: cve,cve2015,rce,rails,ruby
 
 requests:
   - method: GET
@@ -39,3 +39,5 @@ requests:
           - "data-session-id="
         case-insensitive: true
         condition: or
+
+# Enhanced by mp on 2022/05/10