Multiple High-Severity Flaw Affect Widely Used OpenLiteSpeed Web Server Software

Multiple high-severity flaws have been uncovered in the open
source OpenLiteSpeed Web Server as well as its enterprise variant
that could be weaponized to achieve remote code execution.

“By chaining and exploiting the vulnerabilities, adversaries
could compromise the web server and gain fully privileged remote
code execution,” Palo Alto Networks Unit 42 said^[1]
in a Thursday report.

OpenLiteSpeed^[2], the open source edition
of LiteSpeed Web Server, is the sixth most popular web server,
accounting for 1.9 million unique servers across the world.

The first of the three flaws is a directory traversal flaw
(CVE-2022-0072^[3], CVSS score: 5.8), which
could be exploited to access forbidden files in the web root
directory.

The remaining two vulnerabilities (CVE-2022-0073^[4]
and CVE-2022-0074^[5], CVSS scores: 8.8)
relate to a case of privilege escalation and command injection,
respectively, that could be chained to achieve privileged code
execution.

“A threat actor who managed to gain the credentials to the
dashboard, whether by brute-force attacks or social engineering,
could exploit the vulnerability in order to execute code on the
server,” Unit 42 researchers Artur Avetisyan, Aviv Sasson, Ariel
Zelivansky, and Nathaniel Quist said of CVE-2022-0073.

Multiple versions of OpenLiteSpeed (from 1.5.11 up to 1.7.16)
and LiteSpeed (from 5.4.6 up to 6.0.11) are impacted by the issues,
which have been addressed in versions 1.7.16.1^[6]
and 6.0.12^[7]
following responsible disclosure on October 4, 2022.