Applications using frameworks that trust the RFC 7239 Forwarded header by default are exposed when their proxy does not support or sanitize that header. The provided information identifies Ruby on Rails and Spring as frameworks affected by this trust behavior.
An attacker needs to be able to send a request containing a crafted Forwarded header to an affected application. The issue arises when the application accepts that header even though the intervening proxy does not handle it.
Yes. The issue described is that common frameworks, including Spring and Ruby on Rails, trust the Forwarded header in default configurations.
Review framework configuration and change it so the application does not trust the Forwarded header unless it is supplied and controlled by a supporting proxy. Other frameworks may also require application-level configuration changes to be secure.