CVE-2017-6396 Webpagetest Project CVE debrief

Who should care

Operators and developers responsible for WebPageTest 3.0 deployments, especially any instance exposing compare-cf.php or related comparison features to users. Security teams should also care if the application is used in shared, authenticated, or internal environments where browser-session abuse could expose data or actions.

Technical summary

The published NVD record classifies the flaw as CWE-79 (Cross-Site Scripting) with CVSS 3.0 vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N. The weakness is described as insufficient filtration of untrusted input sent to compare-cf.php, enabling script or HTML injection that executes in the browser under the vulnerable site’s origin. The supplied corpus does not include proof-of-concept details, but it does identify a vendor issue tracker reference and third-party references associated with the issue.

Defensive priority

Medium. Prioritize if the application is internet-facing, widely used by authenticated users, or embedded in workflows where browser-origin trust matters. Because exploitation requires user interaction, the risk is lower than unauthenticated server compromise, but the browser-context impact can still be significant.

Recommended defensive actions

• Review and patch the WebPageTest deployment to address input handling in compare-cf.php and any related comparison endpoints.
• Apply context-appropriate output encoding and server-side validation for all user-controlled parameters rendered into HTML or JavaScript contexts.
• Add a temporary server-side filter or web application firewall rule if immediate patching is not possible, focusing on compare-cf.php request parameters.
• Audit logs and application telemetry for unusual requests to compare-cf.php and for suspicious script-bearing input patterns.
• Restrict access to WebPageTest to trusted users or internal networks until remediation is confirmed.
• Verify the deployed version and confirm whether the vendor issue referenced in the corpus resulted in a fixed release or local mitigation.

Evidence notes

The debrief is based only on the supplied NVD-derived record and referenced links. The record states: WebPageTest 3.0, insufficient filtration of user-supplied data in webpagetest-master/www/compare-cf.php, and arbitrary HTML/script execution in the browser context of the vulnerable site. The record also supplies the CVSS vector AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N, CWE-79, and a published date of 2017-03-02. The modified date in the source record is 2026-05-13 and is treated as a record update, not the vulnerability discovery date.

Official resources