Catchpoint Systems WebPageTest 安全漏洞

Catchpoint Systems WebPageTest is an open source tool from Catchpoint Systems to test and analyze the performance of web pages. A security vulnerability exists in WebPageTest 2.6 and earlier versions, which stems from the resultimage.php script that does not validate uploaded files, which could...

CVE-2012-10049: Unrestricted Upload of File with Dangerous Type

WebPageTest version 2.6 and earlier contains an arbitrary file upload vulnerability in the resultimage.php script. The application fails to validate or sanitize user-supplied input before saving uploaded files to a publicly accessible directory. This flaw allows remote attackers to upload and...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg\.. substring...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

WebPageTest Directory Traversal

This module requires Metasploit: https://metasploit.com/download Current source: https://github.com/rapid7/metasploit-framework class MetasploitModule 'WebPageTest Directory Traversal', 'Description' = %q This module exploits a directory traversal vulnerability found in WebPageTest. Due to the wa...

Performance-testing the Google I/O site

I've been looking at the performance of F1 websites recently, but before I dig into the last couple of teams, I figured I'd look a little closer to home, and dig into the Google I/O website. 1. Part 1: Methodology & Alpha Tauri 2. Part 2: Alfa Romeo 3. Part 3: Red Bull 4. Part 4: Williams 5. Part...

Who has the fastest F1 website in 2021? Part 7

This is part 7 in a multi-part series looking at the loading performance of F1 websites. Not interested in F1? It shouldn't matter. This is just a performance review of 10 recently-built/updated sites that have broadly the same goal, but are built by different teams, and have different performanc...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

Directory traversal

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

CVE-2019-17199

CVE-2019-17199 affects WPO WebPageTest 19.04 on Windows via www/getfile.php, where an unanchored regular expression permits Directory Traversal (reading arbitrary files), as demonstrated by the a.jpg.. substring. The issue is triggered in the vulnerable file/component (getfile.php) and weaponizes...

PT-2019-14997

Name of the Vulnerable Software and Affected Versions WPO WebPageTest version 19.04 Description The issue allows for Directory Traversal, enabling the reading of arbitrary files. This is due to an unanchored regular expression in the www/getfile.php file. An example of a malicious substring that...

CVE-2019-17199: Improper Limitation of a Pathname to a Restricted Directory

www/getfile.php in WPO WebPageTest 19.04 on Windows allows Directory Traversal for reading arbitrary files because of an unanchored regular expression, as demonstrated by the a.jpg.. substring...

Server side request forgery (ssrf)

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...

CVE-2019-12161

CVE-2019-12161: The issue affects WPO WebPageTest 19.04 and is due to ValidateURL in www/runtest.php not handling octal-encoded IPs (e.g., 0300.0250 representing 192.168), enabling SSRF. The connected Red Hat and OSV/PRION entries corroborate the SSRF description and reference the same around 201...

CVE-2019-12161

WPO WebPageTest 19.04 allows SSRF because ValidateURL in www/runtest.php does not consider octal encoding of IP addresses such as 0300.0250 as a replacement for 192.168...