CVE-2021-47903 — AI Deep Analysis Summary

🚨 **Nature**: The external application configuration interface has a **command injection** vulnerability. 💥 **Impact**: Can trigger **Remote Code Execution (RCE)**. ⚠️ Attackers can gain full control over the affected se…

🔍 **Root Cause**: External interface does not filter input → **command injection**. 📌 Corresponds to **CWE-77**: Concatenating untrusted input into commands. 🧨 Flaw: Directly concatenating parameters when invoking system…

🎯 **Affected Version**: LiteSpeed Web Server Enterprise **5.4.11**. 📦 **Component**: External application configuration interface module. ❗ Only this version is vulnerable.

👤 **Privilege Required**: Low-privileged user (**PR:L**). 💻 **Can execute arbitrary code** → Take over the server. 📂 **Data Risk**: Read/tamper with/delete sensitive data.

✅ **Low exploitation barrier**! 🔑 Only requires **regular user privileges**. ⚙️ No special configuration or interaction needed (**UI:N**). 🌐 Can be triggered remotely directly.

🧪 **Public exploit available**! 📌 ExploitDB ID: **49523**. 📄 Third-party PoC available at [@ExploitDB-49523]. 🚨 No in-the-wild exploitation data yet (based on provided information).

🔍 **Self-check method**: - Check if version = **5.4.11**?…

🛡️ **Officially fixed** (according to reference link). 📌 Upgrade to a **non-vulnerable version**. 🔗 Product page: [LiteSpeed Web Server Product Page](https://www.litespeedtech.com/products)

⚠️ **Before patch**: - Restrict access IPs for the external application configuration interface. - Disable or remove the interface feature. - Strengthen WAF rules to block suspicious command injection payloads. 🚧 Tempora…

🔥 **Extremely high priority**! 📈 CVSS 3.1 = **9.0+** (H/H/H). 🌍 Network reachable + low barrier = easily exploited in bulk. ⏰ Verify and upgrade immediately!