ID:11994 - Exploit for Input validation error in Ruby on Rails - CVE-2011-3187

Link to public exploit:

Vulnerability description

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to to_s method in actionpack/lib/action_dispatch/middleware/remote_ip.rb in Ruby on Rails does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network. A remote attacker can pass specially crafted input to the application and gain access to potentially sensitive information.

Remediation