CVE-2024-28000 — WordPress LiteSpeed Cache Lab

Authorized local-lab reproduction of CVE-2024-28000, an unauthenticated privilege-escalation issue affecting vulnerable versions of the LiteSpeed Cache WordPress plugin.

Scope: This repository documents testing performed only against an isolated, personally controlled WordPress VM. Do not use these techniques against systems you do not own or have explicit permission to test.

Result

The vulnerability was successfully reproduced end-to-end from a Kali attacker VM against an isolated Ubuntu WordPress target running LiteSpeed Cache 6.2.0.1.

Attack path demonstrated:

1. Enumerated the WordPress target and LiteSpeed Cache installation.
2. Reached the unauthenticated LiteSpeed async crawler handler.
3. Triggered the forced crawler path so the vulnerable role-simulation hash was generated.
4. Generated the vulnerable plugin's deterministic 1,000,000-candidate hash space locally.
5. Recovered the valid role-simulation hash remotely using ffuf and an Administrator-only REST response as the success oracle.
6. Confirmed Administrator context with HTTP 200 from the WordPress users REST API.
7. Created a disposable Administrator account via REST (HTTP 201 Created).
8. Deleted the disposable account after evidence collection.
9. Earlier control testing confirmed LiteSpeed Cache 6.4 rejects the vulnerable cookie technique with HTTP 401.

Lab Topology

The target was placed on a VMware Host-Only network with no default route during exploitation testing.

Target Stack

• Ubuntu Server 22.04
• Apache 2.4.52
• WordPress 7.1
• LiteSpeed Cache 6.2.0.1 — vulnerable test state
• LiteSpeed Cache 6.4 — patched comparison state

Key Finding

A vulnerable LiteSpeed Cache role-simulation hash could be generated and recovered remotely. Supplying the recovered hash together with the Administrator user ID caused WordPress to operate in Administrator context without a normal authenticated WordPress session.

The impact was demonstrated by creating a persistent disposable Administrator account through the WordPress REST API.

Repository Contents

.
├── README.md
├── REPORT.md
├── RUNBOOK.md
├── LICENSE
├── .gitignore
├── docs/
│   ├── architecture.md
│   ├── evidence-checklist.md
│   └── publication-redaction.md
├── scripts/
│   ├── generate_hashes.php
│   └── verify_candidate.sh
└── evidence/
    └── .gitkeep

Responsible Use

This repository is intended for defensive security education, vulnerability reproduction, remediation validation, and portfolio documentation in controlled environments.