OpenLiteSpeed Stored Cross-Site Scripting Vulnerability in Notes Parameter

A stored cross-site scripting vulnerability has been identified in OpenLiteSpeed version 1.7.9. This issue resides in the dashboard's Notes parameter, allowing administrators to inject malicious scripts. The vulnerability can be exploited by crafting a payload in the Notes field during listener configuration, which will execute when an administrator clicks on the Default Icon.

Impact

Exploitation of this vulnerability allows for stored cross-site scripting, where injected scripts are executed in the context of the user.

Reproduction

To reproduce this vulnerability, log into the OpenLiteSpeed dashboard as an administrator. Navigate to 'Listeners' and select 'Summary'. Click on 'Actions', then 'View', and choose 'Edit'. In the 'Notes' parameter, inject a script payload, such as a JavaScript alert. After saving the changes, perform a graceful restart. The injected script will execute when the Default Icon is clicked.