Remote Code Injection Vulnerability in WEBrick HTTP Server by Ruby

CVE-2011-3624

What is CVE-2011-3624?

WEBrick, a simple HTTP server included with Ruby, suffers from a vulnerability that arises from inadequate validation of the X-Forwarded-For, X-Forwarded-Host, and X-Forwarded-Server headers. This can be exploited by remote attackers to inject arbitrary content into log files or to bypass standard address parsing mechanisms through crafted requests. Such weaknesses can lead to potential security breaches if not properly addressed.

References