CVE-2021-43353 : Security Advisory and Response

The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery (CSRF) due to missing nonce validation in versions up to and including 0.31.

Understanding CVE-2021-43353

This CVE involves a security vulnerability in the Crisp Live Chat WordPress plugin that could lead to Cross-Site Request Forgery attacks.

What is CVE-2021-43353?

CVE-2021-43353 is a vulnerability in the Crisp Live Chat WordPress plugin allowing attackers to perform Cross-Site Request Forgery attacks by injecting arbitrary web scripts.

The Impact of CVE-2021-43353

The vulnerability has a CVSSv3.1 base score of 8.8 (High), potentially leading to a significant impact on confidentiality, integrity, and availability of affected systems and data.

Technical Details of CVE-2021-43353

This section covers the specifics of the vulnerability.

Vulnerability Description

The vulnerability arises from missing nonce validation in the crisp_plugin_settings_page function within the ~/crisp.php file.

Affected Systems and Versions

Product: Crisp Live Chat
Versions affected: <= 0.31 (including custom version 0.31)

Exploitation Mechanism

Attackers can exploit this issue by injecting malicious web scripts due to the lack of proper nonce validation.

Mitigation and Prevention

To address CVE-2021-43353, follow these steps:

Immediate Steps to Take

Update the Crisp Live Chat plugin to version 0.32 or newer.

Long-Term Security Practices

Regularly update all plugins and software to patch vulnerabilities.
Implement proper input validation and nonce usage in plugins and themes.

Patching and Updates

Stay informed about security advisories and promptly apply patches and updates to mitigate known vulnerabilities.