CVE-2009-3287: Improper Input Validation

October 24, 2017 (updated September 14, 2021)

lib/thin/connection.rb in Thin web server relies on the X-Forwarded-For header to determine the IP address of the client, which allows remote attackers to spoof the IP address and hide activities via a modified X-Forwarded-For header.

References

github.com/macournoyer/thin/blob/master/CHANGELOG
github.com/macournoyer/thin/commit/7bd027914c5ffd36bb408ef47dc749de3b6e063a
www.openwall.com/lists/oss-security/2009/09/12/1
github.com/advisories/GHSA-j24p-r6wx-r79w
nvd.nist.gov/vuln/detail/CVE-2009-3287

Code Behaviors & Features

Detect and mitigate CVE-2009-3287 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →