徹底解説：WordPress向けLiteSpeed Cacheプラグインにおける格納型XSSの脆弱性（CVE-2024-47374）

private function _ccss()
{
    global $wp;
    $request_url = home_url($wp->request);

    $filepath_prefix = $this->_build_filepath_prefix('ccss');
    $url_tag = $this->_gen_ccss_file_tag($request_url);
    $vary = $this->cls('Vary')->finalize_full_varies();

    ===============  Skip ================

    // Store it to prepare for cron
    Core::comment('QUIC.cloud CCSS in queue');
    $this->_queue = $this->load_queue('ccss');

    if (count($this->_queue) > 500) {
        self::debug('CCSS Queue is full - 500');
        return null;
    }

    $queue_k = (strlen($vary) > 32 ? md5($vary) : $vary) . ' ' . $url_tag;
    $this->_queue[$queue_k] = array(
        'url' => apply_filters('litespeed_ccss_url', $request_url),
        'user_agent' => substr($ua, 0, 200),
        'is_mobile' => $this->_separate_mobile(),
        'is_webp' => $this->cls('Media')->webp_support() ? 1 : 0,
        'uid' => $uid,
        'vary' => $vary,
        'url_tag' => $url_tag,
    ); // Current UA will be used to request
    $this->save_queue('ccss', $this->_queue);

public function load($request_url, $dry_run = false)
{
    ===============  Skip ================

    $vary = $this->cls('Vary')->finalize_full_varies();

    ===============  Skip ================

    // Store it for cron
    $this->_queue = $this->load_queue('ucss');

    if (count($this->_queue) > 500) {
        self::debug('UCSS Queue is full - 500');
        return false;
    }

    $queue_k = (strlen($vary) > 32 ? md5($vary) : $vary) . ' ' . $url_tag;
    $this->_queue[$queue_k] = array(
        'url' => apply_filters('litespeed_ucss_url', $request_url),
        'user_agent' => substr($ua, 0, 200),
        'is_mobile' => $this->_separate_mobile(),
        'is_webp' => $this->cls('Media')->webp_support() ? 1 : 0,
        'uid' => $uid,
        'vary' => $vary,
        'url_tag' => $url_tag,
    ); // Current UA will be used to request
    $this->save_queue('ucss', $this->_queue);

public function finalize_full_varies()
{
    $vary = $this->_finalize_curr_vary_cookies(true);
    $vary .= $this->finalize_default_vary(get_current_user_id());
    $vary .= $this->get_env_vary();
    return $vary;
}

/**
    * Get request environment Vary
    *
    * @since  4.0
    */
public function get_env_vary()
{
    $env_vary = isset($_SERVER['LSCACHE_VARY_VALUE']) ? $_SERVER['LSCACHE_VARY_VALUE'] : false;
    if (!$env_vary) {
        $env_vary = isset($_SERVER['HTTP_X_LSCACHE_VARY_VALUE']) ? $_SERVER['HTTP_X_LSCACHE_VARY_VALUE'] : false;
    }
    return $env_vary;
}

<?php if (!empty($ucss_queue)) : ?>
    <div class="litespeed-callout notice notice-warning inline">
        <h4>
            <?php echo sprintf(__('URL list in %s queue waiting for cron', 'litespeed-cache'), 'UCSS'); ?> ( <?php echo count($ucss_queue); ?> )
            <a href="<?php echo Utility::build_url(Router::ACTION_UCSS, UCSS::TYPE_CLEAR_Q); ?>" class="button litespeed-btn-warning litespeed-right">Clear</a>
        </h4>
        <p>
            <?php $i = 0;
            foreach ($ucss_queue as $k => $v) : ?>
                <?php if ($i++ > 20) : ?>
                    <?php echo '...'; ?>
                    <?php break; ?>
                <?php endif; ?>
                <?php if (!is_array($v)) continue; ?>
                <?php if (!empty($v['_status'])) : ?><span class="litespeed-success"><?php endif; ?>
                    <?php echo esc_html($v['url']); ?>
                    <?php if (!empty($v['_status'])) : ?></span><?php endif; ?>
                <?php if ($pos = strpos($k, ' ')) echo ' (' . __('Vary Group', 'litespeed-cache') . ':' . substr($k, 0, $pos) . ')'; ?>
                <?php if ($v['is_mobile']) echo ' <span data-balloon-pos="up" aria-label="mobile">📱</span>'; ?>
                <?php if (!empty($v['is_webp'])) echo ' WebP'; ?>
                <br />
            <?php endforeach; ?>
        </p>
    </div>

VULNERABLE_VERSIONS = [
    r"(?P<major_0_to_5>[0-5])\.(?P<minor>[0-9]+)(\.(?P<patch>[0-9]+))?",
    r"(?P<major_6_0_to_4>6)\.(?P<minor_0_to_4>[0-4])(\.(?P<patch>[0-9]+))?",
    r"(?P<major_6_5>6)\.5\.0(\.(?P<patch_0_to_2>[0-2]))$",
]

class CVE202447374Exploit(webexploit.WebExploit):
    accept_request = definitions.Request(
        method="GET", path="/wp-content/plugins/litespeed-cache/readme.txt"
    )
    check_request = definitions.Request(
        method="GET", path="/wp-content/plugins/litespeed-cache/readme.txt"
    )
    accept_pattern = [re.compile("LiteSpeed Cache")]
    match_pattern = [
        re.compile(f"Stable tag: {version}") for version in VULNERABLE_VERSIONS
    ]

pip install -U ostorlab

oxo agent install agent/ostorlab/asteroid

oxo scan run --agent agent/ostorlab/asteroid link --url <target-URL> --method GET