CVE-2015-3224 Exploit - Rails Web Console RCE

A JavaScript implementation (Node.js) of the exploit for CVE-2015-3224. This tool targets Ruby on Rails applications running vulnerable versions of the web-console gem, allowing unauthenticated Remote Code Execution (RCE).

About the Vulnerability

CVE-2015-3224 allows an attacker to bypass the IP whitelist protection of the Rails web-console gem.

The web-console is a debugging tool intended to be used only during development. By default, it restricts access to the 127.0.0.1 (localhost) IP address. However, vulnerable versions verify the client's IP address based on the X-Forwarded-For HTTP header without proper validation.

By crafting a request with a specific spoofed IP (e.g., 0000::1), an attacker can trick the application into believing the request is coming from a trusted local source. Since the console evaluates Ruby code, this leads to immediate Remote Code Execution (RCE).

How it Works

This script automates the exploitation process in two main steps:

1. Reconnaissance & Path Extraction:

   • The script forces a 404 error on the target to trigger the Rails debug page.
   • It parses the HTML response to extract the hidden data-remote-path, which is a unique session ID required to interact with the console.

2. Payload Injection:

   • It constructs a PUT request to the discovered console path.
   • It injects the X-Forwarded-For: 0000::1 header to bypass the IP check.
   • It sends the user-defined command inside the input parameter (properly formatted as a form-url-encoded body).
   • Finally, it extracts and cleans the command output from the JSON response.

Prerequisites

• Node.js (v18 or higher recommended for native fetch support).

Usage

Clone the repository and run the script directly with Node.js:

# Syntax
node exploit.js [TARGET_URL] [COMMAND]

# Example
node exploit.js http://vulnerable-site.com "uname -a"

Example Output

[*] Target: http://vulnerable-site.com
[*] Command: whoami
[+] Console path found: console/repl_sessions/cd984a0d............

[+] Command Output:
---------------------------------------------------

webrick

---------------------------------------------------

Mitigation

To fix this vulnerability, update the web-console gem to version 2.1.3 or higher in your Gemfile:

gem 'web-console', '>= 2.1.3'

Alternatively, ensure that the web console is strictly disabled in production environments.

License

Distributed under the MIT License.