A critical vulnerability has been identified in LiteSpeed Cache (LS Cache), a widely used WordPress plugin installed on over five million sites. This vulnerability, designated as CVE-2024-3246, allows attackers to inject malicious code into websites, potentially compromising sensitive data and granting control over affected sites.
Vulnerability Details
- Vulnerability ID: CVE-2024-3246
- Vulnerability Type: Cross-Site Request Forgery (CSRF) leading to Stored Cross-Site Scripting (XSS)
- Severity Level: High
- CVSS Score: Pending evaluation
- Affected Software: LiteSpeed Cache plugin versions 6.2.0.1 and earlier
Technical Analysis
The vulnerability in the LiteSpeed Cache plugin arises from missing or incorrect nonce validation, making it susceptible to CSRF attacks. This flaw allows unauthenticated attackers to exploit the plugin by tricking a site administrator into performing actions, such as clicking on a malicious link. The process is as follows:
- CSRF Exploitation:
- Attackers craft a malicious link that, when clicked by a site administrator, triggers a forged request to the website.
- Token Setting Update:
- The forged request can update the token setting in the plugin.
- Malicious JavaScript Injection:
- Attackers inject malicious JavaScript, leading to stored XSS. This script executes whenever an administrator accesses the affected settings page, compromising the site and potentially its visitors.
Potential Impact
The CVE-2024-3246 vulnerability poses a severe risk as it allows attackers to inject malicious code into websites, potentially leading to:
- Data breaches
- Unauthorized control over the website
- Compromised site security for both administrators and visitors
Given the widespread use of the LiteSpeed Cache plugin, millions of WordPress sites are potentially vulnerable to these attacks.
Mitigation
Recommended Actions:
- Update Immediately: Update the LiteSpeed Cache plugin to the latest version (6.3 or later), which contains a fix for this vulnerability.
- Check for Compromise: Review your site’s user accounts for any unauthorized administrators or suspicious activity.
- Strengthen Security: Implement additional security measures, such as a web application firewall (WAF), to further protect your website from potential attacks.
CVE-2024-3246 is a critical CSRF vulnerability in the LiteSpeed Cache plugin for WordPress that requires immediate attention. Site administrators must update their plugins and enhance their security measures to mitigate potential risks. The widespread adoption of LiteSpeed Cache makes this vulnerability particularly dangerous, necessitating prompt action to protect millions of websites.
