PoC for the CVE-2024 Litespeed Cache Privilege Escalation # CVE-2024-28000 PoC
This repository contains tools for exploiting the CVE-2024-28000 vulnerability affecting WordPress sites using the LiteSpeed Cache plugin. The included scripts automate the detection of exposed debug.log files and the exploitation of a privilege escalation vulnerability that allows unauthorized users to gain administrator-level access. An extensive Documentation on this Vulnerability can be found here: https://patchstack.com/articles/critical-privilege-escalation-in-litespeed-cache-plugin-affecting-5-million-sites?_s_id=cve
# Features
1. checkdebuglog.py
Purpose: Scans WordPress sites for exposed debug.log files.
How it Works:
The script sends HTTP requests to the /wp-content/debug.log endpoint.
It uses multithreading to efficiently process multiple URLs, determining if the log file is accessible.
2. exploit.py
Purpose: Exploits a privilege escalation vulnerability in the LiteSpeed Cache plugin.
How it Works:
Step 1: The script triggers the generation of a cache file via an AJAX request to the WordPress site, which simulates a LiteSpeed crawler.
Step 2: It exploits a flaw in the cache or hash mechanism, allowing the attacker to access a privileged session without brute-forcing the hash.
Step 3: If successful, the attacker can hijack an admin session or gain unauthorized access to administrator functionalities.
# Usage
Clone the Repository:
```sh
git clone https://github.com/yourusername/CVE-2024-28000.git
cd CVE-2024-28000
```
Run checkdebuglog.py:
```sh
python3 checkdebuglog.py
```
Input: A list of target URLs.
Output: Identifies URLs with exposed debug.log files.
Run exploit.py:
```sh
python3 exploit.py
```
# Mitigation
The vulnerability has been addressed in LiteSpeed Cache plugin version 6.4 and above. Users are strongly encouraged to update to the latest version to mitigate the risk.
# Disclaimer
This tool is intended for educational purposes and authorized security testing only. Unauthorized use of this tool on systems you do not own or have explicit permission to test is illegal and unethical.
[4.0K] /data/pocs/228f9b3a77600c9a7f2daae50abc96319d7246f1
├── [1.5K] checkdebuglog.py
├── [3.4K] exploit.py
├── [ 11K] LICENSE
└── [2.1K] README.md
0 directories, 4 files