Description
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
alexjustesen speedtest-tracker
Default version status: unaffected
0 to ≤ 1.15.0affected
pkg:github/alexjustesen/speedtest-trackerReferences
- https://hackmd.io/@haind03/speedtest-tracker-trust-proxies-allowlist-bypass ↗
- https://github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7/bootstrap/app.php#L23-L41 ↗
- https://github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7/app/Http/Middleware/AllowedIpAddressesMiddleware.php#L16-L27 ↗
- https://github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7/app/Http/Middleware/PrometheusAllowedIpMiddleware.php#L22-L42 ↗
- https://github.com/alexjustesen/speedtest-tracker ↗
- https://www.vulncheck.com/advisories/speedtest-tracker-through-1.15.0-ip-allowlist-bypass-via-x-forwarded-for-spoofing ↗