CVE-2011-3187

Name of the Vulnerable Software and Affected Versions Ruby on Rails version 3.0.5

Description The issue concerns the to s method in actionpack/lib/action dispatch/middleware/remote ip.rb, which fails to validate the X-Forwarded-For header in requests from IP addresses on a Class C network. This could allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.

Recommendations For Ruby on Rails version 3.0.5, consider validating the X-Forwarded-For header to prevent arbitrary text injection into log files or address parsing bypass. As a temporary workaround, restrict access to the to s method in actionpack/lib/action dispatch/middleware/remote ip.rb to minimize the risk of exploitation.