Atti Abderrahim
Table of Contents
A critical vulnerability has been discovered in the popular WordPress plugin LiteSpeed Cache, used by over 6 million websites. This flaw allows attackers to control a site by stealing session cookies from administrators. Although a patch has been released, millions of websites remain vulnerable.
Overview of LiteSpeed Cache and Its Popularity
LiteSpeed Cache is one of the most widely used plugins for speeding up WordPress sites by optimizing and caching content. However, this popularity comes with risks, as a security flaw was found in March 2024. Unfortunately, the plugin is again under scrutiny due to a new critical vulnerability.
Discovery of the Vulnerability
On August 22, 2024, security researcher Rafie Muhammad from Patchstack identified a critical vulnerability in LiteSpeed Cache’s debugging feature. This flaw logs all HTTP response headers, including session cookies used to authenticate users.
How the Vulnerability Can Be Exploited
The vulnerability is alarmingly easy to exploit. By accessing the “debug.log” file, typically located in the directory “/wp-content/plugins/LiteSpeed-cache/,” an attacker can retrieve these session cookies and impersonate any logged-in user, including site administrators. The only requirement is that the plugin’s debugging mode has been activated at least once.
If an administrator logged into the WordPress back-office while this option was enabled, their session cookies could have been stored in the log file. Hackers scanning websites for this accessible file could steal these cookies and take full control of the site without needing an account.
Urgent Update Required
To address this flaw, LiteSpeed Technologies released version 6.5.0.1 of the plugin on September 4, 2024. The update moves the log file to a subdirectory with a random name, removes the option to log cookies, and adds access restrictions to prevent direct viewing of the log file.
However, despite over 6 million sites using this plugin, only 375,000 had applied the security update on the day of its release. This means over 5.6 million WordPress sites are still vulnerable to this attack and urgently need to be patched.
Immediate Actions for Site Administrators
In the meantime, administrators of sites using an older version of LiteSpeed Cache are strongly advised to manually delete any existing “debug.log” files, which may contain valid session cookies. Additionally, adding a .htaccess rule to block direct access to logs can help protect against exploitation attempts. If you are unfamiliar with these terms, consulting a qualified web admin is recommended.
Conclusion
This vulnerability highlights the importance of keeping WordPress plugins up to date, especially those as widely used as LiteSpeed Cache. Website administrators should act quickly to apply the necessary patches and take additional security measures to protect their sites from attacks. With millions of sites still at risk, the urgency to update cannot be overstated.
Source : Bleeping Computer
