PT-2021-16364 · WordPress · Tawk.To Live Chat

Quentin Villain · Published 2021-12-06 · Updated 2022-10-24 · CVE-2021-24914

Positive Technologies (AI Summary)

CVSS v3.1

8.0

High

Base vector

AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Tawk.To Live Chat WordPress plugin versions prior to 0.6.0

Description: The issue concerns the lack of capability and CSRF checks in the tawkto setwidget and tawkto removewidget AJAX actions, which are available to any authenticated user. This allows low-privileged users, including simple subscribers, to change the tawkto-embed-widget-page-id and tawkto-embed-widget-widget-id parameters, effectively linking the vulnerable website to their own Tawk.to instance. As a result, they can monitor the website, interact with its visitors by receiving and answering contact messages, and display an arbitrary Knowledge Base. Additionally, the tawkto removewidget action can remove the live chat widget from pages.

Recommendations: For versions prior to 0.6.0, update to version 0.6.0 or later to resolve the issue. As a temporary workaround, consider restricting access to the tawkto setwidget and tawkto removewidget AJAX actions to prevent unauthorized changes. Additionally, restrict the ability to change the tawkto-embed-widget-page-id and tawkto-embed-widget-widget-id parameters to only trusted users.

Exploit

Fix

Missing Authorization

CSRF

Weakness Enumeration

CWE-862

CWE-352

Related Identifiers

CVE-2021-24914

Affected Products

Tawk.To Live Chat

References · 4

• 🔥 https://wpscan.com/vulnerability/39392055-8cd3-452f-8bcb-a650f5bddc2e · Exploit
• https://osv.dev/vulnerability/CVE-2021-24914 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-24914 · Security Note
• https://t.me/cibsecurity/33390 · Telegram Post