Vulnerability in alexjustesen speedtest-tracker

[ Description ]Official description

Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.

[ Fixes ]Fixes and patches

No fix or interim patch is linked from our sources yet. Check the vendor references below and limit exposure of affected systems until a fix is available.

[ References ]References

• github.com/alexjustesen/speedtest-tracker
• github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7…
• github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7…
• github.com/alexjustesen/speedtest-tracker/blob/fce6eb36181ed70b5b0763c391a50b806d7e3da7…
• hackmd.io/@haind03/speedtest-tracker-trust-proxies-allowlist-bypass
• www.vulncheck.com/advisories/speedtest-tracker-through-1.15.0-ip-allowlist-bypass-via-x…