The host is running Ruby on Rails, which is prone to HTTP Header Injection Vulnerability.

Successful attack could lead to execution of arbitrary HTML or scripting code in the context of an affected application or allow Cross Site Request Forgery (CSRF), Cross Site Scripting (XSS) and HTTP Request Smuggling Attacks. Impact Level: Application

Upgrade to higher Version or Apply patches from, http://github.com/rails/rails/commit/7282ed863ca7e6f928bae9162c9a63a98775a19d ***** NOTE: Ignore this warning, if above mentioned patch is manually applied. *****

Input passed to the redirect_to() function is not properly sanitized before being used.

Ruby on Rails Version before 2.0.5 on Linux.

• http://weblog.rubyonrails.org/2008/10/19/response-splitting-risk
• http://www.rorsecurity.info/journal/2008/10/20/header-injection-and-response-splitting.html

---

Updated on 2015-03-25