Summary:
A critical unauthenticated site-wide stored XSS vulnerability, tracked as CVE-2023-40000, has been identified in the LiteSpeed Cache plugin for WordPress. With over 4 million active installations, the plugin exposes WordPress sites to the risk of sensitive information theft or privilege escalation through a single HTTP request. Exploiting the flaw involves the lack of input sanitization and output escaping in user-handled code, compounded by inadequate access control on a REST API endpoint. Specifically, the vulnerability stems from the 'update_cdn_status' function, wherein HTML construction directly from a POST body parameter for admin notice messages occurs. Remediation is achieved through sanitizing user input with esc_html on the affected parameter and implementing permission checks on the 'update_cdn_status' function, reinforced with hash validation to limit access solely to privileged users. Security measures recommended to mitigate such risks include applying proper escaping and sanitization to admin notice messages, utilizing functions like sanitize_text_field and esc_html depending on data context, and enforcing authorization checks on registered REST route endpoints.[/subscribe_to_unlock_form]
Summary:
A critical unauthenticated site-wide stored XSS vulnerability, tracked as CVE-2023-40000, has been identified in the LiteSpeed Cache plugin for WordPress. With over 4 million active installations, the plugin exposes WordPress sites to the risk of sensitive information theft or privilege escalation through a single HTTP request. Exploiting the flaw involves the lack of input sanitization and output escaping in user-handled code, compounded by inadequate access control on a REST API endpoint. Specifically, the vulnerability stems from the 'update_cdn_status' function, wherein HTML construction directly from a POST body parameter for admin notice messages occurs. Remediation is achieved through sanitizing user input with esc_html on the affected parameter and implementing permission checks on the 'update_cdn_status' function, reinforced with hash validation to limit access solely to privileged users. Security measures recommended to mitigate such risks include applying proper escaping and sanitization to admin notice messages, utilizing functions like sanitize_text_field and esc_html depending on data context, and enforcing authorization checks on registered REST route endpoints.[emaillocker id="1283"]
Recommendations:
References:
The following reports contain further technical details:
https://securityaffairs.com/159667/hacking/litespeed-cache-plugin-xss.html
[/emaillocker]