Critical Security Flaw Found in LiteSpeed Cache Plugin for WordPress
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-28000 | Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: Incorrect Privilege Assignment vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache.This issue affects LiteSpeed Cache: from n/a through <= 6.3.0.1. NVD description · AI analysis pending | 9.8 | 68% |
| — | ||
| CVE-2024-44000 | Unauthenticated Account Takeover in WordPress LiteSpeed Cache Plugin CVE-2024-44000 is an insufficiently protected credentials flaw (CWE-522) in the LiteSpeed Cache WordPress plugin that permits an authentication bypass, allowing an unauthenticated remote attacker to take over user accounts, including administrators. The weakness affects LiteSpeed Cache versions prior to 6.5.0.1 and is reachable over the network with no privileges or user interaction required (CVSS 9.8). An attacker who exploits it can bypass login protections and gain administrative control of the affected WordPress site, potentially leading to full site takeover. Any WordPress site running a LiteSpeed Cache version below 6.5.0.1 is affected. Exploitation has not been added to CISA's KEV catalog and no public proof-of-concept is known, but an EPSS score of 82.3% (100th percentile) indicates a very high probability of exploitation activity in the next 30 days. Do: Upgrade LiteSpeed Cache to version 6.5.0.1 or later immediately, given the unauthenticated, critical-severity nature of the flaw and the very high EPSS score. After patching, review administrator accounts and audit logs for signs of unexpected logins or account takeover, and rotate privileged credentials if compromise is suspected. | 9.8 | 82% |
| mass≈5,000,000+ WordPress sites (plugin has over 5 million active installs) |
Full article430 words · extracted from thehackernews.com · click to collapse
Ravie LakshmananSep 06, 2024WordPress / Webinar Security
Cybersecurity researchers have discovered yet another critical security flaw in the LiteSpeed Cache plugin for WordPress that could allow unauthenticated users to take control of arbitrary accounts.
The vulnerability, tracked as CVE-2024-44000 (CVSS score: 7.5), impacts versions before and including 6.4.1. It has been addressed in version 6.5.0.1.
"The plugin suffers from an unauthenticated account takeover vulnerability which allows any unauthenticated visitor to gain authentication access to any logged-in users and at worst can gain access to an Administrator level role after which malicious plugins could be uploaded and installed," Patchstack researcher Rafie Muhammad said.
The discovery follows an extensive security analysis of the plugin, which previously led to the identification of a critical privilege escalation flaw (CVE-2024-28000, CVSS score: 9.8). LiteSpeed Cache is a popular caching plugin for the WordPress ecosystem with over 5 million active installations.
The new vulnerability stems from the fact that a debug log file named "/wp-content/debug.log" is publicly exposed, which makes it possible for unauthenticated attackers to view potentially sensitive information contained in the file.
This could also include user cookie information present within HTTP response headers, effectively allowing users to log in to a vulnerable site with any session that is actively valid.
The lower severity of the flaw is owing to the prerequisite that the debug feature must be enabled on a WordPress site for it to be successful. Alternatively, it could also affect sites that had activated the debug log feature at some point in the past, but have failed to remove the debug file.
It's important to note that this feature is disabled by default. The patch addresses the problem by moving the log file to a dedicated folder within the LiteSpeed plugin folder ("/wp-content/litespeed/debug/"), randomizing filenames, and dropping the option to log cookies in the file.
Users are advised to check their installations for the presence of the "/wp-content/debug.log" and take steps to purge them if the debugging feature has (or had) been enabled.
It's also recommended to set an .htaccess rule to deny direct access to the log files as malicious actors can still directly access the new log file if they know the new filename by means of a trial-and-error method.
"This vulnerability highlights the critical importance of ensuring the security of performing a debug log process, what data should not be logged, and how the debug log file is managed," Muhammad said.
Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.
Text extracted automatically; images, tables and formatting may be missing. Original: https://thehackernews.com/2024/09/critical-security-flaw-found-in.html