LiteSpeed Vulnerabilities Can Lead to Complete Web Server Takeover

guest · Nov 12, 2022

By Eduard Kovacs @EduardKovacs - November 11, 2022

LiteSpeed Web Server vulnerabilities discovered by researchers at Palo Alto Networks can be exploited to take complete control of a targeted server.
Click to expand...

The security holes were discovered during an audit of OpenLiteSpeed, the open source version of the LiteSpeed performance-focused web server made by LiteSpeed Technologies. Both versions are impacted by the vulnerabilities and they have been patched with the release of OpenLiteSpeed 1.7.16.1 and LiteSpeed 6.0.12.

LiteSpeed is a popular web server and an analysis by Palo Alto Networks showed that it has a 2% market share — others say that it has a much bigger market share — and that it is used by 1.9 million internet-facing instances.
Click to expand...

The vulnerabilities discovered by the security firm’s researchers can be exploited to compromise the targeted web server and execute arbitrary code with elevated privileges.
Click to expand...

Palo Alto Networks - Unit42: Unit 42 Finds Three Vulnerabilities in OpenLiteSpeed Web Server

Executive Summary
The Unit 42 research team has researched and discovered three different vulnerabilities in the open source OpenLiteSpeed Web Server. These vulnerabilities also affect the enterprise version, LiteSpeed Web Server. By chaining and exploiting the vulnerabilities, adversaries could compromise the web server and gain fully privileged remote code execution. The vulnerabilities discovered include:

Remote Code Execution (CVE-2022-0073) rated High severity (CVSS 8.8)

Privilege Escalation (CVE-2022-0074) rated High severity (CVSS 8.8)

Directory Traversal (CVE-2022-0072) rated Medium severity (CVSS 5.8)

Click to expand...

Log in or Sign up

LiteSpeed Vulnerabilities Can Lead to Complete Web Server Takeover

guest Guest

Log in or Sign up

LiteSpeed Vulnerabilities Can Lead to Complete Web Server Takeover

guest Guest

Useful Searches