# Fixing PHP Code Injection in Speedtest Tracker (Docker)

## 1. Update the Image Immediately

The primary fix is updating to a patched release. Check the project's security advisories first ([github.com/alexjustesen/speedtest-tracker/security/advisories](https://github.com/alexjustesen/speedtest-tracker/security/advisories)) to identify the fixed version, then pull and recreate:

```bash
# With Docker Compose
docker compose pull
docker compose down
docker compose up -d

# With plain Docker
docker pull lscr.io/linuxserver/speedtest-tracker:latest
docker stop speedtest-tracker
docker rm speedtest-tracker
# recreate with your original run command/flags
```

Verify the running version:

```bash
docker exec speedtest-tracker php artisan --version
```

**Tip:** Pin to a specific version tag (e.g., `lscr.io/linuxserver/speedtest-tracker:v0.x.x`) rather than `latest` so you know exactly what you're running.

## 2. If No Patch Is Available Yet — Mitigate Exposure

Until an official fix lands, reduce the attack surface:

- **Don't expose the app to the internet.** Bind to localhost or LAN only:
```yaml
ports:
- "127.0.0.1:8080:80"
```
- **Put it behind an authenticating reverse proxy** (Authelia, Authentik, or at minimum HTTP basic auth via nginx/Traefik).
- **Restrict to VPN access** (WireGuard, Tailscale).

## 3. Harden the Container

Add these to your compose file to limit damage if code execution occurs:

```yaml
services:
speedtest-tracker:
image: lscr.io/linuxserver/speedtest-tracker:latest
read_only: true
tmpfs:
- /tmp
cap_drop:
- ALL
security_opt:
- no-new-privileges:true
```

You can also disable dangerous PHP functions by mounting a custom `php.ini` override with:

```ini
disable_functions = exec,shell_exec,system,passthru,proc_open,popen,eval
```

(Test first — some Laravel features may depend on these.)

## 4. If You Suspect Exploitation

A code injection flaw may already have been abused if the instance was publicly accessible:

1. **Stop and destroy the container** — never just restart it:
```bash
docker compose down
docker compose up -d --force-recreate
```
2. **Inspect the persistent volume** (`/config` mount) for unexpected `.php` files, webshells, or recently modified files you didn't create.
3. **Rotate all secrets:** `APP_KEY`, database credentials, API tokens, and any notification service tokens (Telegram, Discord, etc.) in your `.env`.
4. **Review logs** for suspicious requests:
```bash
docker logs speedtest-tracker 2&1 | grep -iE "php|eval|base64|cmd"
```
5. Check the database for unauthorized admin users or changed settings.

## 5. Stay Updated Going Forward

- Enable notifications on the GitHub repo (Watch → Custom → Releases + Security alerts).
- Consider a container update tool like Diun or WUD to alert on new image versions.
- Subscribe to LinuxServer.io's Discord/announcements if you use their image.

If you can share the specific CVE or advisory ID you're referencing, I can give more targeted remediation steps.

Question

# Fixing PHP Code Injection in Speedtest Tracker (Docker)

## 1. Update the Image Immediately

The primary fix is updating to a patched release. Check the project's security advisories first ([github.com/alexjustesen/speedtest-tracker/security/advisories](https://github.com/alexjustesen/speedtest-tracker/security/advisories)) to identify the fixed version, then pull and recreate:

```bash
# With Docker Compose
docker compose pull
docker compose down
docker compose up -d

# With plain Docker
docker pull lscr.io/linuxserver/speedtest-tracker:latest
docker stop speedtest-tracker
docker rm speedtest-tracker
# recreate with your original run command/flags
```

Verify the running version:

```bash
docker exec speedtest-tracker php artisan --version
```

**Tip:** Pin to a specific version tag (e.g., `lscr.io/linuxserver/speedtest-tracker:v0.x.x`) rather than `latest` so you know exactly what you're running.

## 2. If No Patch Is Available Yet — Mitigate Exposure

Until an official fix lands, reduce the attack surface:

- **Don't expose the app to the internet.** Bind to localhost or LAN only:
  ```yaml
  ports:
    - "127.0.0.1:8080:80"
  ```
- **Put it behind an authenticating reverse proxy** (Authelia, Authentik, or at minimum HTTP basic auth via nginx/Traefik).
- **Restrict to VPN access** (WireGuard, Tailscale).

## 3. Harden the Container

Add these to your compose file to limit damage if code execution occurs:

```yaml
services:
  speedtest-tracker:
    image: lscr.io/linuxserver/speedtest-tracker:latest
    read_only: true
    tmpfs:
      - /tmp
    cap_drop:
      - ALL
    security_opt:
      - no-new-privileges:true
```

You can also disable dangerous PHP functions by mounting a custom `php.ini` override with:

```ini
disable_functions = exec,shell_exec,system,passthru,proc_open,popen,eval
```

(Test first — some Laravel features may depend on these.)

## 4. If You Suspect Exploitation

A code injection flaw may already have been abused if the instance was publicly accessible:

1. **Stop and destroy the container** — never just restart it:
   ```bash
   docker compose down
   docker compose up -d --force-recreate
   ```
2. **Inspect the persistent volume** (`/config` mount) for unexpected `.php` files, webshells, or recently modified files you didn't create.
3. **Rotate all secrets:** `APP_KEY`, database credentials, API tokens, and any notification service tokens (Telegram, Discord, etc.) in your `.env`.
4. **Review logs** for suspicious requests:
   ```bash
   docker logs speedtest-tracker 2>&1 | grep -iE "php|eval|base64|cmd"
   ```
5. Check the database for unauthorized admin users or changed settings.

## 5. Stay Updated Going Forward

- Enable notifications on the GitHub repo (Watch → Custom → Releases + Security alerts).
- Consider a container update tool like Diun or WUD to alert on new image versions.
- Subscribe to LinuxServer.io's Discord/announcements if you use their image.

If you can share the specific CVE or advisory ID you're referencing, I can give more targeted remediation steps.

Accepted Answer

将 Docker 镜像更新到 `linuxserver/docker-speedtest-tracker` 的 `v1.15.0-ls176` 或更高版本，该版本包含已修复的 PHP 版本。对于 Docker Compose，请运行：

```bash
docker compose pull
docker compose up -d
```

Speedtest Tracker 镜像基于 LinuxServer.io (LSIO) 基础镜像，因此 PHP 安全补丁依赖于 LSIO 的发布。请在 https://github.com/linuxserver/docker-speedtest-tracker/releases 查看已修复的版本，并在更新后验证正在运行的镜像标签。

Speedtest Tracker

核心功能

避坑指南

适用场景

详细介绍

常见问题与排障 (1)

标签

快速上手

相似推荐