Authenticated (editor+) server-side request forgery in different sections

Skrevet den af i LiteSpeed Cache

Server-side request forgery available in many modules. This makes it possible for authenticated attackers, with Editor-level access and above, to make web requests to arbitrary locations originating from the web application which can be used to query and modify information from internal services.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1
  • LiteSpeed Cache 6.5.2
  • LiteSpeed Cache 6.5.3
  • LiteSpeed Cache 6.5.4
  • LiteSpeed Cache 7.0
  • LiteSpeed Cache 7.0.0.1
  • LiteSpeed Cache 7.0.1

Unauthenticated Sensitive Information Exposure via Debug Log Files

Skrevet den af i LiteSpeed Cache

Patch removes all debug-level logging of HTTP response headers and request cookies, disables the “Log Cookies” option entirely, and relocates debug files into a hard-to-guess directory (/wp-content/litespeed/debug/) with randomized filenames based on the site’s AUTH_KEY. It also adds an index.php to block directory listings and updates .htaccess to deny direct access to log files, fully preventing unauthenticated attackers from downloading sensitive data.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1

Authenticated (Administrator+) stored cross-site scripting

Skrevet den af i LiteSpeed Cache

Due to insufficient input sanitization and output escaping, authenticated attackers with administrator-level permissions or higher can inject arbitrary web scripts into pages, which will execute whenever a user accesses an affected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1

Unauthenticated privilege escalation via is_role_simulation()

Skrevet den af i LiteSpeed Cache

The is_role_simulation() function lacks proper authorization checks, allowing unauthenticated attackers to simulate privileged roles (e.g., Administrator), potentially granting them elevated access to the site.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2
  • LiteSpeed Cache 6.5.1

Authenticated (Contributor+) Stored Cross-Site Scripting

Skrevet den af i LiteSpeed Cache

Due to insufficient input sanitization and output escaping, authenticated attackers with contributor-level access or higher can inject arbitrary web scripts into pages, which will execute whenever a user accesses an affected page.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 3.6.4
  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1
  • LiteSpeed Cache 6.4
  • LiteSpeed Cache 6.4.1
  • LiteSpeed Cache 6.5
  • LiteSpeed Cache 6.5.0.1
  • LiteSpeed Cache 6.5.0.2

Unauthenticated Privilege Escalation

Skrevet den af i LiteSpeed Cache

The plugin fails to properly restrict the role simulation functionality, allowing attackers to spoof their user ID as an administrator if they obtain or brute force a valid hash, potentially found in debug logs. This vulnerability enables unauthenticated attackers to create new administrator accounts via the `/wp-json/wp/v2/users` REST API endpoint.

This vulnerability affects the following application versions:

  • LiteSpeed Cache 4.0
  • LiteSpeed Cache 4.1
  • LiteSpeed Cache 4.2
  • LiteSpeed Cache 4.3
  • LiteSpeed Cache 4.4
  • LiteSpeed Cache 4.4.1
  • LiteSpeed Cache 4.4.2
  • LiteSpeed Cache 4.4.3
  • LiteSpeed Cache 4.4.4
  • LiteSpeed Cache 4.4.5
  • LiteSpeed Cache 4.4.6
  • LiteSpeed Cache 4.4.7
  • LiteSpeed Cache 4.5
  • LiteSpeed Cache 4.5.0.1
  • LiteSpeed Cache 4.6
  • LiteSpeed Cache 5.0
  • LiteSpeed Cache 5.0.0.1
  • LiteSpeed Cache 5.0.1
  • LiteSpeed Cache 5.1
  • LiteSpeed Cache 5.2
  • LiteSpeed Cache 5.2.1
  • LiteSpeed Cache 5.3
  • LiteSpeed Cache 5.3.1
  • LiteSpeed Cache 5.3.2
  • LiteSpeed Cache 5.3.3
  • LiteSpeed Cache 5.4
  • LiteSpeed Cache 5.5
  • LiteSpeed Cache 5.5.1
  • LiteSpeed Cache 5.6
  • LiteSpeed Cache 5.7
  • LiteSpeed Cache 5.7.0.1
  • LiteSpeed Cache 6.0
  • LiteSpeed Cache 6.0.0.1
  • LiteSpeed Cache 6.1
  • LiteSpeed Cache 6.2
  • LiteSpeed Cache 6.2.0.1
  • LiteSpeed Cache 6.3
  • LiteSpeed Cache 6.3.0.1