PT-2022-9534 · WordPress · Litespeed Cache

Emil Kylander · Published 2022-01-03 · Updated 2022-01-08 · CVE-2021-24964

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions LiteSpeed Cache WordPress plugin versions prior to 4.4.4

Description The issue arises from the plugin not properly verifying requests from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. Additionally, an endpoint can be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitized and escaped. This can be exploited by an unauthenticated attacker to put Cross-Site Scripting payloads in pages visited by users.

Recommendations For versions prior to 4.4.4, update to version 4.4.4 or later to resolve the issue. As a temporary workaround, consider disabling the setting that enables CSS code injection until a patch is available. Restrict access to the vulnerable endpoints to minimize the risk of exploitation. Avoid using the X-Forwarded-For header value in the affected API endpoints until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2021-24964

Affected Products

Litespeed Cache

References · 5

• 🔥 https://wpscan.com/vulnerability/e9966b3e-2eb9-4d70-8c18-6a829b4827cc · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2021-24964 · Security Note
• https://osv.dev/vulnerability/CVE-2021-24964 · Vendor Advisory
• https://t.me/cibsecurity/34849 · Telegram Post
• https://t.me/cvenotify/25128 · Telegram Post