Unit 42 Finds Three Vulnerabilities in Open Lite Speed Web Server
Summary: Unit 42 discovered three vulnerabilities in OpenLiteSpeed Web Server that also affect the enterprise LiteSpeed Web Server, and chaining them lets an adversary with admin dashboard credentials gain fully privileged remote code execution. The flaws are CVE-2022-0073 (command injection in the External App Command field), CVE-2022-0074 (a PATH misconfiguration in the Docker image allowing privilege escalation from nobody to root), and CVE-2022-0072 (a directory traversal bypassing regex checks), disclosed to LiteSpeed Technologies on Oct. 4, 2022 and patched in v1.7.16.1 and 6.0.12 on Oct. 18, 2022.
What's compelling: LiteSpeed serves roughly 2% of all web server applications, with nearly 1.9 million unique internet-facing servers globally, and the attack chain starts with nothing more than stolen admin dashboard credentials.
Read the original at Unit 42 Palo Alto Networks ↗
- Topics
- Supply Chain & AppSec
- Mentions
- CVE-2022-0073CVE-2022-0074
- Related
- Kitesurf is now open source Cyber Risks · Nov 13, 2026Trained to betray: How post-training supply chain attacks hijack coding agents Cyber Risks · Nov 12, 2026ZDI-26-913: (0Day) Meta fairseq load_audio_path Code Injection Remote Code Execution Vulnerability Cyber Risks · Nov 11, 2026