This popular open-source web server has some serious security flaws
Patch for OpenLiteSpeed Web Server is available
When you purchase through links on our site, we may earn an affiliate commission.Here’s how it works.
OpenLiteSpeed Web Server, a globally popular open-source webserver, was carrying a couple of high-severity vulnerabilities, experts have warned.
Threat actors that managed to exploit these flaws would have been given full privilege remote code execution capabilities, noted researchers from Unit 42, Palo Alto Networks’ cybersecurity researcharm.
The team found OpenLiteSpeed Web Server carried three high-severity vulnerabilities, namely CVE-2022-0073 (an 8.8 severity score, high-severity remote code execution flaw), CVE-2022-0074 (an 8.8 high-severity privilege escalation flaw), and CVE-2022-0072 (a 5.8, medium-severity directory traversal flaw). The vulnerabilities also affected the enterprise version, LiteSpeed Web Server.
Patch ready
Unit 42 has notified LiteSpeed Technologies of its findings which has, subsequently, patched the flaws, and released new versions of the server, urging users to update their software immediately.
Organizations using OpenLiteSpeed versions 1.5.11 - 1.7.16, as well as LiteSPeed versions 5.4.6 - 6.0.11 are urged to bring theirendpointsup to 1.7.16.1 and 6.0.12 as soon as possible.
According to Unit 42, the LiteSpeed Web Server is the sixth most popular web ofering around, serving roughly 2% of all Web Server applications, with almost 1.9 million unique servers around the world.
What are the different types of web hosting?>Buying a web hosting service? Check these 10 tips>Keep your devices safe from malware with these tools
“We tried to imitate the actions of an adversary and engaged in research with the intention of finding vulnerabilities and disclosing them to the vendor,” the researchers explained in ablog post.
Are you a pro? Subscribe to our newsletter
Sign up to the TechRadar Pro newsletter to get all the top news, opinion, features and guidance your business needs to succeed!
“This research has resulted in finding three vulnerabilities that affect both the enterprise and open source solutions. These could be chained and exploited by an adversary who has the credentials for the admin dashboard, in order to gain privileged code execution on vulnerable components.”
Web servers have come a long way in terms of security and protections, Unit 42 concludes, adding that despite the optimistic outlook, vulnerabilities are still being found due to the rapid pace of technological evolution.
Sead is a seasoned freelance journalist based in Sarajevo, Bosnia and Herzegovina. He writes about IT (cloud, IoT, 5G, VPN) and cybersecurity (ransomware, data breaches, laws and regulations). In his career, spanning more than a decade, he’s written for numerous media outlets, including Al Jazeera Balkans. He’s also held several modules on content writing for Represent Communications.
Windows PCs targeted by new malware hitting a vulnerable driver
Dangerous Android banking malware looks to trick victims with fake money transfers
Apple iMac 24-inch M4 (2024) review: the best, and most colorful, all-in-one computer levels up
