WordPress LiteSpeed Cache plugin flaw could allow site takeover
Vulnerabilities mentionedAll →
| CVE | Vulnerability | CVSS | EPSS | Flags | Affected | Exposure | Published |
|---|---|---|---|---|---|---|---|
| CVE-2024-44000 | Unauthenticated Account Takeover in WordPress LiteSpeed Cache Plugin CVE-2024-44000 is an insufficiently protected credentials flaw (CWE-522) in the LiteSpeed Cache WordPress plugin that permits an authentication bypass, allowing an unauthenticated remote attacker to take over user accounts, including administrators. The weakness affects LiteSpeed Cache versions prior to 6.5.0.1 and is reachable over the network with no privileges or user interaction required (CVSS 9.8). An attacker who exploits it can bypass login protections and gain administrative control of the affected WordPress site, potentially leading to full site takeover. Any WordPress site running a LiteSpeed Cache version below 6.5.0.1 is affected. Exploitation has not been added to CISA's KEV catalog and no public proof-of-concept is known, but an EPSS score of 82.3% (100th percentile) indicates a very high probability of exploitation activity in the next 30 days. Do: Upgrade LiteSpeed Cache to version 6.5.0.1 or later immediately, given the unauthenticated, critical-severity nature of the flaw and the very high EPSS score. After patching, review administrator accounts and audit logs for signs of unexpected logins or account takeover, and rotate privileged credentials if compromise is suspected. | 9.8 | 82% |
| mass≈5,000,000+ WordPress sites (plugin has over 5 million active installs) | ||
| CVE-2024-47374 | Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache all Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache litespeed-cache allows Stored XSS.This issue affects LiteSpeed Cache: from n/a through <= 6.5.0.2. NVD description · AI analysis pending | 6.1 | 1% |
| — |
Full article535 words · extracted from securityaffairs.com · click to collapse
A high-severity flaw in the WordPress LiteSpeed Cache plugin could allow attackers to execute arbitrary JavaScript code under certain conditions.
A high-severity security flaw, tracked as CVE-2024-47374 (CVSS score 7.2), in the LiteSpeed Cache plugin for WordPress could allow attackers to execute arbitrary JavaScript.
The vulnerability is a stored cross-site scripting (XSS) issue impacting versions up to 6.5.0.2.
This LiteSpeed Cache plugin is an all-in-one site acceleration tool, offering server-level caching and optimization features. It supports WordPress Multisite and is compatible with popular plugins like WooCommerce, bbPress, and Yoast SEO. LiteSpeed Cache has over six million active installations, for this reason, site admins must address the issue as soon as possible.
The vulnerability was originally reported by TaiYou to the Patchstack bug bounty program for WordPress.
“This plugin suffers from unauthenticated stored XSS vulnerability. It could allow any unauthenticated user from stealing sensitive information to, in this case, privilege escalation on the WordPress site by performing a single HTTP request.” reads the advisory.
The flaw arises from improper sanitization of the “X-LSCACHE-VARY-VALUE” HTTP header, allowing arbitrary script injection. The issue could be exploited only if the “CSS Combine” and “Generate UCSS” settings are enabled.
An attacker could potentially exploit this vulnerability to hijack the account of a site administrator and take full control of the website.
The vulnerability was addressed in version 6.5.1 on September 25, 2024.
The most damaging scenario is when the hijacked user account is that of a site administrator, thereby allowing a threat actor to completely take control of the website and stage even more powerful attacks.
“We recommend applying escaping and sanitization to any message that will be displayed as an admin notice. Depending on the context of the data, we recommend using sanitize_text_field to sanitize value for HTML output (outside of HTML attribute) or esc_html. For escaping values inside of attributes, you can use the esc_attr function.” concludes the report. “We also recommend applying a proper permission or authorization check to the registered rest route endpoints.”
In early September, the developer behind the LiteSpeed Cache plugin addressed another unauthenticated account takeover vulnerability, tracked as CVE-2024-44000 (CVSS score: 7.5), that can allow any visitor to gain access to logged-in users and potentially escalate privileges to the Administrator level. An attacker can exploit this vulnerability to upload malicious plugins.
Patchstack researchers explained that the flaw stems from an HTTP response header leak that exposed “Set-Cookie” headers in a debug log file (/wp-content/debug.log) after login attempts.
An unauthenticated attacker can view sensitive information, including user cookie data from HTTP response headers. This could enable attackers to log in using any valid session. The flaw can be exploited only if the WordPress site’s debug feature is enabled and this feature is disabled by default.
“The vulnerability exploits an HTTP response headers leak on the debug log file which also leaks the “Set-Cookie” header after the users perform a login request.” reads the report published by Patchstack. “The main vulnerable code exists on the function ended“
The vulnerability CVE-2024-44000 impacts versions before and including 6.4.1. The issue has been addressed in version 6.5.0.1.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, WordPress)
Text extracted automatically; images, tables and formatting may be missing. Original: https://securityaffairs.com/169390/security/wordpress-litespeed-cache-plugin-flaw-site-takeover.html