Remote Code Exposure Vulnerability in LiteSpeed Web Server by LiteSpeed Technologies
CVE-2010-2333

Currently unrated

Key Information:

Vendor

Litespeedtech

Status
Litespeed Web Server
Vendor
CVE Published:
18 June 2010

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 60%

What is CVE-2010-2333?

A vulnerability exists in LiteSpeed Technologies LiteSpeed Web Server versions 4.0.x prior to 4.0.15 that allows remote attackers to exploit a null byte injection. By appending a .txt file extension to an HTTP request, attackers can read the source code of server scripts. This issue poses significant risks to the confidentiality and integrity of sensitive content hosted on the server. It's recommended that users upgrade to version 4.0.15 or later to mitigate this risk and ensure the security of their web applications.

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2010-2333 - Proof of Concept

References

http://www.exploit-db.com/exploits/13850
exploitx_refsource_EXPLOIT-DB
http://www.litespeedtech.com/latest/litespeed-web-server-...
x_refsource_CONFIRM
http://osvdb.org/65476
vdb-entryx_refsource_OSVDB

EPSS Score

60% chance of being exploited in the next 30 days.

Timeline

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability published

  • Vulnerability Reserved

.