Speedtest Tracker
Monthly
IP allowlist bypass in Speedtest Tracker through 1.15.0 lets unauthenticated remote attackers defeat both the ALLOWED_IPS restriction and the Prometheus endpoint allowlist by spoofing the X-Forwarded-For header, giving them read access to /prometheus metrics and other allowlist-gated web and API endpoints. The root cause is that bootstrap/app.php trusts every peer as a reverse proxy, so any client-supplied forwarding header is accepted as the real client IP. Impact is limited to information disclosure and reaching allowlist-protected routes; endpoints that separately require an application login are not necessarily compromised. No confirmed active exploitation (CISA KEV) is reported, though a public technical writeup of the bypass technique is referenced and no fixed version is identified in the available data.
IP allowlist bypass in Speedtest Tracker through 1.15.0 lets unauthenticated remote attackers defeat both the ALLOWED_IPS restriction and the Prometheus endpoint allowlist by spoofing the X-Forwarded-For header, giving them read access to /prometheus metrics and other allowlist-gated web and API endpoints. The root cause is that bootstrap/app.php trusts every peer as a reverse proxy, so any client-supplied forwarding header is accepted as the real client IP. Impact is limited to information disclosure and reaching allowlist-protected routes; endpoints that separately require an application login are not necessarily compromised. No confirmed active exploitation (CISA KEV) is reported, though a public technical writeup of the bypass technique is referenced and no fixed version is identified in the available data.