CVE-2021-24914 : Exploit Details and Defense Strategies

This article provides insights into CVE-2021-24914, a vulnerability in the Tawk.To Live Chat WordPress plugin before version 0.6.0 that exposes websites to unauthorized monitoring and chat interaction.

Understanding CVE-2021-24914

CVE-2021-24914 highlights a security flaw in Tawk.To Live Chat plugin versions earlier than 0.6.0, allowing authenticated users, including low-privileged subscribers, to manipulate parameters and link vulnerable websites to external Tawk.to instances.

What is CVE-2021-24914?

The vulnerability in the Tawk.To Live Chat WordPress plugin before version 0.6.0 lacks capability and Cross-Site Request Forgery (CSRF) checks, enabling unauthorized users to monitor websites and engage with visitors through visitor monitoring and chat manipulation.

The Impact of CVE-2021-24914

The security issue permits any authenticated user to connect a compromised site to their own Tawk.to instance, resulting in the ability to monitor, interact with visitors, receive messages, and display arbitrary content.

Technical Details of CVE-2021-24914

The technical details of CVE-2021-24914 encompass the vulnerability description, affected systems and versions, and the exploitation mechanism.

Vulnerability Description

The Tawk.To Live Chat WordPress plugin before 0.6.0 lacks authorization and CSRF checks in critical AJAX actions, enabling unauthorized manipulation of essential parameters.

Affected Systems and Versions

The vulnerability affects Tawk.To Live Chat plugin versions before 0.6.0, exposing websites to potential unauthorized monitoring and chat widget removal.

Exploitation Mechanism

Unauthorized users, including low-privileged subscribers, can exploit the vulnerability to link vulnerable websites to external Tawk.to instances, allowing them to interact with visitors and display arbitrary content.

Mitigation and Prevention

Protecting against CVE-2021-24914 involves immediate actions and long-term security measures, including patching and updates.

Immediate Steps to Take

Website administrators should update the Tawk.To Live Chat plugin to version 0.6.0 or later to mitigate the vulnerability and prevent unauthorized monitoring and chat manipulation.

Long-Term Security Practices

Ensure regular security audits, monitor plugin updates, and implement robust authorization and CSRF checks to prevent similar vulnerabilities in the future.

Patching and Updates

Continuously update plugins and software to the latest versions to address known security issues and enhance overall website security.