Developers of WP Live Chat Support plugin, which has more than 50,000 installations, report that users should immediately upgrade plugin to version 8.0.33 or later.
The fact is that in plugin was detected critical vulnerability that allows an attacker who does not have valid credentials to bypass authentication mechanism.WP Live Chat Support allows adding to the website free chat through which employees can provide support and assistance to resource visitors.
Experts from Alert Logic found that plugin versions 8.0.32 and below allow an unauthenticated attacker to gain access to REST API endpoints, which should not be available under normal circumstances. The vulnerability received the identifier CVE-2019-12498. Due to exploitation of the bug, an attacker can not only steal all the logs of already completed chats, but also interfere with still active chat sessions.
The researchers say that with the help of a bug, an attacker can insert his own messages into active chats, edit them, and carry out DoS attacks, due to which chat sessions will be urgently terminated.
“Note that we had not seen attackers attempt this specific bypass in our customer data, and do not believe that it was being actively exploited”, — report researchers.
The primary resolution of this vulnerability is to update the plugin to the latest version. If this cannot be achieved, then mitigation options may include:
Virtual patching using a WAF to filter traffic destined for the WP Live Chat Support REST endpoint
Interestingly, in the past month, Sucuri’s specialists discovered another dangerous problem in WP Live Chat Support -XSS bug, which allowed automating attacks on vulnerable sites and introducing malicious code without authentication. Criminals quickly began to exploit this vulnerability.
Concluding, according to ZScaler ThreatLabZ, attackers injected malicious JavaScript on vulnerable sites, which organized forced redirects and was responsible for arrival of pop-up windows and fake subscriptions.
Source: https://blog.alertlogic.com
