Rails, Spring and Jetty trust Forwarded headers proxies often ignore
If a proxy only rewrites X-Forwarded-* headers, a client-supplied Forwarded value can override client IP, host and scheme.
3
Stories per day · 30 days
1 RSS
Relatedimagemagick2active-storage1arbitrary-file1cache-poisoning1file-write1forwarded-header1ip-spoofing1llm-agents1open-source1ruby1ruby-on-rails1spring1x-forwarded-for1
6 stories, newest first · one card per story
Stories tagged #rails
Critical Rails Bug Threatens to Derail Vulnerable Servers
Rails Active Storage ImageMagick integration allows arbitrary file read and write.
Rails flaw lets attackers write files via ImageMagick uploads
Ruby on Rails Active Storage before 8.1.4.1 and 8.0.5.2 allows arbitrary file write and read of secrets via crafted uploads processed by ImageMagick.
2
Ruby on Rails 8.0.5.2 and 8.1.4.1 security releases
Ruby on Rails 8.0.5.2 and 8.1.4.1 have been released with security fixes.
Ruby gem author archives repositories over AI-era development
The maintainer says Ruby is being repositioned for LLM agents and will no longer maintain gems by hand.
[object Object]
Huntress raised Claude Fable 5.1 Rails API recall from 48% to 100% with three harness changes.