OpenLiteSpeed WebAdmin Default Login Detection Scanner

OpenLiteSpeed WebAdmin is a user-friendly web administration console used for managing and configuring the OpenLiteSpeed Web Server. It is commonly utilized by web administrators and hosting providers to oversee server operations and settings. The primary purpose of this console is to provide an easy-to-navigate platform for managing server configurations, enhancing automation, and optimizing server performance. The console supports various web server management services, thereby making it popular in environments where OpenLiteSpeed is employed. It is essential for both novice and experienced administrators alike, offering a blend of ease and functionality.

The vulnerability arises from the use of default login credentials that are often left unchanged after initial installation. Many administrators overlook this critical step, assuming that the console is not exposed to external networks. However, default credentials are widely known and can be easily exploited by attackers. This oversight introduces a significant security risk, as it allows unauthorized individuals to access the administrative interface without any authentication challenges.

Technically, the scanner probes the OpenLiteSpeed WebAdmin login endpoint, typically located at /admin or /webadmin, and attempts authentication using common default username and password pairs such as admin/admin or root/root. If successful, it confirms the presence of default credentials. This endpoint is designed for server configuration and management, making it a high-value target for attackers seeking to compromise the entire web server.

The potential impact of exploiting this vulnerability is severe. An attacker with administrative access can modify server settings, deploy malicious configurations, intercept traffic, or launch further attacks on the network. This can lead to data breaches, service disruptions, and reputational damage. Given the CVSS score of 8.0, this vulnerability poses a high risk and requires immediate remediation to protect the server and its hosted applications.