LiteSpeed Web Server 5.1.0 HTTP Header Injection

Type packetstorm
Reporter Onur YILMAZ
Modified 2016-01-20T00:00:00


Advisory by Netsparker  
Name: HTTP Header Injection in LiteSpeed Web Server  
Affected Software : LiteSpeed Web Server  
Affected Versions: v5.1.0 and possibly below  
Vendor Homepage :  
Vulnerability Type : HTTP Header Injection  
Severity : Medium  
Status : Fixed  
Netsparker Advisory Reference : NS-16-001  
While testing Netsparker, we spotted an HTTP Header Injection  
vulnerability in LiteSpeed.  
LiteSpeed Web Server v5.1.0 and possibly below are affected if  
mod_userdir is enabled. This vulnerability can be exploited in various  
ways depending on the application.  
Technical Details  
Proof of Concept URL for HTTP Header Injection in LiteSpeed Web Server:  
Advisory Timeline  
15 Jan 2016 - First Contact  
18 Jan 2016 - Vendor Fixed  
20 Jan 2016 - Advisory Released  
Patch released by LiteSpeed and annocunced here:  
Download the latest version.  
Credits & Authors  
This issue has been discovered by Ziyahan Albeniz while testing  
Netsparker Web Application Security Scanner  
About Netsparker  
Netsparker web application security scanners find and report security  
flaws and vulnerabilities such as SQL Injection and Cross-site  
Scripting (XSS) in all websites and web applications, regardless of  
the platform and technology they are built on. Netsparker scanning  
engine’s unique detection and exploitation techniques allow it to be  
dead accurate in reporting vulnerabilities, hence it does not report  
any false positives. The Netsparker web application security scanner  
is available in two editions; Netsparker Desktop and Netsparker Cloud.  
Visit our website for more information.  
Onur Yılmaz - National General Manager  
Netsparker Web Application Security Scanner  
T: +90 (0)554 873 0482