# RCE due to Web Console IP Whitelist bypass in Rails 4.0 and 4.1

Web Console IP whitelist bypassed via IPv6 notation `0000::1` in X-Forwarded-For, giving RCE through arbitrary Ruby evaluation in Rails 4.0/4.1 dev environments.

- Payout: hidden
- Severity: high
- Program: Ruby on Rails
- Found by: joernchen
- Disclosed: 2015-06-16
- CVE: CVE-2015-3224
- Write-up quality: 7/10
- Original: https://hackerone.com/reports/44513
- Library page: https://bugbountylibrary.com/r/h1%3A44513
- Tags: area:web domain:web impact:rce kind:bounty platform:hackerone sev:high tech:ruby technique:parser-differential vuln:access-control vuln:auth-bypass vuln:rce

**Target:** Rails Web Console middleware (request.remote_ip / IPAddr whitelist)
**Root cause:** Parser differential: Rails <4.2 TRUSTED_PROXIES regex `^::1$` fails to strip `0000::1` from X-Forwarded-For, but Web Console's IPAddr check normalizes it to `::1`, so the spoofed address passes the whitelist.
**Steps:**
1. Enable Web Console (default in Rails 4.0/4.1 dev/test).
2. Send request with header `X-Forwarded-For: 0000::1`.
3. Rails remote_ip leaves the value intact (regex `^::1$` doesn't match `0000::1`).
4. Web Console IPAddr check parses `0000::1` as `::1` and allows access.
5. Use the console to evaluate arbitrary Ruby statements -> RCE.
**How found:** Noticed Web Console uses Ruby IPAddr to validate request.remote_ip while Rails <4.2 uses regexes to strip trusted proxies from X-Forwarded-For/Client-IP; hypothesized a notation that the regex misses but IPAddr normalizes to ::1.
**Exploitation:** Attacker sends a crafted HTTP request with `X-Forwarded-For: 0000::1` to a Rails app with Web Console enabled; the whitelist is bypassed and the console accepts arbitrary Ruby evaluation, yielding remote code execution.
**Insight:** When two components parse the same IP/header with different parsers (regex vs IPAddr), hunt for alternate notations (leading zeros, IPv6 forms) that one normalizes and the other doesn't.