CVE-2021-47855

Overview

OpenLiteSpeed 1.7.9 is affected by a stored cross-site scripting (XSS) vulnerability in the web administration dashboard. The flaw resides in the 'Notes' parameter used during listener configuration. User-supplied input is not properly sanitized before being stored and later rendered in the admin interface, leading to the injection and execution of arbitrary script code [2][3]. The root cause is a lack of output encoding for the Notes field within the listener editing pages.

Exploitation

Exploitation requires an authenticated administrator account. An attacker with admin privileges can navigate to Listeners > Summary > select View Actions > Edit for a specific listener, then inject malicious JavaScript into the 'Notes' field [2]. After performing a Graceful Restart of the server, the payload is stored. The XSS triggers when an administrator visits the listener configuration page and clicks on the Default Icon element, which renders the unsanitized Notes content [2]. No additional user interaction beyond a single click on that icon is needed.

Impact

Successful exploitation enables the attacker to execute arbitrary JavaScript in the context of the admin dashboard. This could lead to session hijacking, administrative actions performed on behalf of the victim, or further compromise of the web server through the admin interface. The CVSS v3 score of 7.2 reflects a high severity due to the need for prior authentication but the potential for significant impact [3].

Mitigation

As of the available references, no patch or updated version is explicitly mentioned. Affected users should consider upgrading to a newer version of OpenLiteSpeed if available, or applying strict input validation and output encoding for the Notes field. Restricting administrative dashboard access to trusted users reduces the attack surface.