From Litespeed: -
A security issue has been fixed in LiteSpeed Web Server (Enterprise) related to how Apache configuration is handled. The fix is available now in LSWS v6.3.7 build 9 and v6.4.0 RC2 build 7.
Under certain configurations, the issue could allow access to files outside a site's document root, or allow scripts to run without suEXEC. On shared hosting servers using CageFS, this could let a user escape their CageFS environment and, in the worst case, gain root-level access to the server.
Please upgrade immediately. All LSWS installations should be upgraded to v6.3.7 build 9, or v6.4.0 RC2 build 7 if you run the 6.4 release candidate, as soon as possible.
Affected product: LiteSpeed Web Server (Enterprise)
Affected versions: All versions prior to the fixed versions below
Most at risk: Shared hosting servers using Apache configuration with suEXEC and CageFS
Fixed in: v6.3.7 build 9 or v6.4.0 RC2 build 7
Severity: Critical
Status: Fix available now
ACTION REQUIRED (immediately)
We strongly recommend upgrading all LSWS installations immediately:
• If you run LSWS 6.3.x, upgrade to v6.3.7 build 9.
• If you run the 6.4 release candidate branch, upgrade to v6.4.0 RC2 build 7. This build includes all of the updates listed in this email.
You can upgrade from the LSWS WebAdmin Console, or from the command line:
/usr/local/lsws/admin/misc/lsup.sh -f -v 6.3.7
Post-upgrade steps
• Confirm that the new version (v6.3.7 build 9 or v6.4.0 RC2 build 7) is running.
• Check that sites using HTTP authentication still work as expected, since authentication handling is now stricter.
• On shared servers, look for signs of compromise: unfamiliar processes, files or cron jobs, and unexpected root-level or cross-account activity.
If you believe a server may have been compromised, in addition to upgrading:
• Rotate server credentials, and the database credentials and access tokens stored in hosted accounts.
• Contact our support team for help with the investigation.
