CVE-2024-32890: Insufficient Information (NVD-CWE-noinfo)
value: librespeed/speedtest is an open source, self-hosted speed test for HTML5. In affected versions missing neutralization of the ISP information in a speedtest result leads to stored Cross-site scripting in the JSON API. The `processedString` field in the `ispinfo` parameter is missing neutralization. It is stored when a user submits a speedtest result to the telemetry API (`results/telemetry.php`) and returned in the JSON API (`results/json.php`). This vulnerability has been introduced in commit 3937b94. This vulnerability affects LibreSpeed speedtest instances running version 5.2.5 or higher which have telemetry enabled and has been addressed in version 5.3.1. Users are advised to upgrade. There are no known workarounds for this vulnerability.
CWE description: There is insufficient information about the issue to classify it; details are unkown or unspecified.
Published: 2024-05-01T07:15Z
Repository: https://github.com/librespeed/speedtest
Language: PHP
Files changed: results/json.php, speedtest.js
Commit date: 2024-04-27 15:12:32 +0200
Commit message: Fixed vulnerability in json.php caused my missing Content-Type header

Diff: diff --git a/results/json.php b/results/json.php
index 9730d20..1e87e8e 100755
--- a/results/json.php
+++ b/results/json.php
@@ -1,7 +1,10 @@
 <?php
 
+error_reporting(0);
+header('Content-Type: application/json; charset=utf-8');
+
 require_once 'telemetry_db.php';
 
 /**
  * @param int|float $d
  *
@@ -51,9 +54,9 @@ function formatSpeedtestData($speedtest)
 }
 
 $speedtest = getSpeedtestUserById($_GET['id']);
 if (!is_array($speedtest)) {
     echo '{}';
+} else {
+    $speedtest = formatSpeedtestData($speedtest);
+    echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
 }
-$speedtest = formatSpeedtestData($speedtest);
-
-echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
diff --git a/speedtest.js b/speedtest.js
index ad5985a..386fd22 100755
--- a/speedtest.js
+++ b/speedtest.js
@@ -47,11 +47,11 @@ function Speedtest() {
   this._serverList = []; //when using multiple points of test, this is a list of test points
   this._selectedServer = null; //when using multiple points of test, this is the selected server
   this._settings = {}; //settings for the speed test worker
   this._state = 0; //0=adding settings, 1=adding servers, 2=server selection done, 3=test running, 4=done
   console.log(
-    "LibreSpeed by Federico Dossena v5.3.0 - https://github.com/librespeed/speedtest"
+    "LibreSpeed by Federico Dossena v5.3.1 - https://github.com/librespeed/speedtest"
   );
 }
 
 Speedtest.prototype = {
   constructor: Speedtest,

Vulnerable code: $speedtest = formatSpeedtestData($speedtest);

echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
    "LibreSpeed by Federico Dossena v5.3.0 - https://github.com/librespeed/speedtest"
Fixed code: error_reporting(0);
header('Content-Type: application/json; charset=utf-8');

} else {
    $speedtest = formatSpeedtestData($speedtest);
    echo json_encode(array('timestamp'=>$speedtest['timestamp'],'download'=>$speedtest['dl'],'upload'=>$speedtest['ul'],'ping'=>$speedtest['ping'],'jitter'=>$speedtest['jitter'],'ispinfo'=>$speedtest['ispinfo']));
    "LibreSpeed by Federico Dossena v5.3.1 - https://github.com/librespeed/speedtest"