CyberRota Analysis
AI-GeneratedThe vulnerability allows unauthenticated remote attackers to bypass IP allowlists in Speedtest Tracker versions up to 1.15.0 by spoofing X-Forwarded-For headers, enabling access to sensitive Prometheus metrics and protected web and API endpoints. Organizations utilizing this software should prioritize remediation to prevent unauthorized access to potentially sensitive data. This is particularly critical for those managing sensitive metrics or APIs that rely on IP-based access controls.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Speedtest Tracker through 1.15.0 contains an IP allowlist bypass vulnerability that allows unauthenticated remote attackers to evade ALLOWED_IPS and Prometheus allowlists by spoofing X-Forwarded-For headers. Because bootstrap/app.php trusts every peer as a proxy, attackers can supply an allowlisted address to read /prometheus metrics and reach protected web and API endpoints.