PT-2024-24943 · Unknown · Librespeed Speedtest

N-Thumann · Published 2024-05-01 · Updated 2024-05-01 · CVE-2024-32890

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions librespeed/speedtest versions 5.2.5 through 5.3.0

Description The issue arises from missing neutralization of the ISP information in a speedtest result, leading to stored Cross-site scripting in the JSON API. The processedString field in the ispinfo parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (results/telemetry.php) and returned in the JSON API (results/json.php). This vulnerability was introduced in commit 3937b94 and affects LibreSpeed speedtest instances with telemetry enabled.

Recommendations For versions 5.2.5 through 5.3.0, upgrade to version 5.3.1 to address the issue. As a temporary workaround, consider disabling the telemetry API (results/telemetry.php) and the JSON API (results/json.php) until the upgrade is possible. Restrict access to the ispinfo parameter to minimize the risk of exploitation. Avoid using the processedString field in the ispinfo parameter until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2024-32890

GHSA-3954-XRWH-FQ4Q

Affected Products

Librespeed Speedtest

References · 9

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/32xxx/CVE-2024-32890.json · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2024-32890 · Security Note
• https://osv.dev/vulnerability/CVE-2024-32890 · Vendor Advisory
• https://github.com/librespeed/speedtest/commit/dd1ce2cb8830d94dcaa0b8e70b9406144a0e5f8d · Note
• https://github.com/librespeed/speedtest/commit/3937b940e80b734acae36cd41a2a31819593e728 · Note
• https://github.com/librespeed/speedtest/security/advisories/GHSA-3954-xrwh-fq4q · Note
• https://t.me/cvenotify/78669 · Telegram Post
• https://twitter.com/CVEnew/status/1785569977837498748 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1785623756645323196 · Twitter Post