Home » News » Vulnerability in WP Live Chat Support plugin allows stealing logs and insert messages in chats

Vulnerability in WP Live Chat Support plugin allows stealing logs and insert messages in chats

Developers of WP Live Chat Support plugin, which has more than 50,000 installations, report that users should immediately upgrade plugin to version 8.0.33 or later.

The fact is that in plugin was detected critical vulnerability that allows an attacker who does not have valid credentials to bypass authentication mechanism.

WP Live Chat Support allows adding to the website free chat through which employees can provide support and assistance to resource visitors.

Experts from Alert Logic found that plugin versions 8.0.32 and below allow an unauthenticated attacker to gain access to REST API endpoints, which should not be available under normal circumstances. The vulnerability received the identifier CVE-2019-12498. Due to exploitation of the bug, an attacker can not only steal all the logs of already completed chats, but also interfere with still active chat sessions.

The researchers say that with the help of a bug, an attacker can insert his own messages into active chats, edit them, and carry out DoS attacks, due to which chat sessions will be urgently terminated.

“Note that we had not seen attackers attempt this specific bypass in our customer data, and do not believe that it was being actively exploited”, — report researchers.

Remediation and Mitigation from Alert Logic

The primary resolution of this vulnerability is to update the plugin to the latest version. If this cannot be achieved, then mitigation options may include:

Virtual patching using a WAF to filter traffic destined for the WP Live Chat Support REST endpoint

Interestingly, in the past month, Sucuri’s specialists discovered another dangerous problem in WP Live Chat Support -XSS bug, which allowed automating attacks on vulnerable sites and introducing malicious code without authentication. Criminals quickly began to exploit this vulnerability.

READ  In Atlassian Confluence Server is found vulnerability through which intruders can upload malware programs

Concluding, according to ZScaler ThreatLabZ, attackers injected malicious JavaScript on vulnerable sites, which organized forced redirects and was responsible for arrival of pop-up windows and fake subscriptions.

Source: https://blog.alertlogic.com

[Total: 0    Average: 0/5]

About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

Adwind attacks energy sector

RAT Trojan Adwind attacks US energy sector

Unknown attackers targeted infrastructure of the US electricity industry. With the help of malicious emails, …

Trojan Bolik masks under NordVPN

Bank Bolik Trojan masks itself under NordVPN

Doctor Web experts warned that attackers use copies of popular services sites to distribute Bolik …

Leave a Reply