Home » News » Vulnerability in WP Live Chat Support plugin allows stealing logs and insert messages in chats

Vulnerability in WP Live Chat Support plugin allows stealing logs and insert messages in chats

Developers of WP Live Chat Support plugin, which has more than 50,000 installations, report that users should immediately upgrade plugin to version 8.0.33 or later.

The fact is that in plugin was detected critical vulnerability that allows an attacker who does not have valid credentials to bypass authentication mechanism.

WP Live Chat Support allows adding to the website free chat through which employees can provide support and assistance to resource visitors.

Experts from Alert Logic found that plugin versions 8.0.32 and below allow an unauthenticated attacker to gain access to REST API endpoints, which should not be available under normal circumstances. The vulnerability received the identifier CVE-2019-12498. Due to exploitation of the bug, an attacker can not only steal all the logs of already completed chats, but also interfere with still active chat sessions.

The researchers say that with the help of a bug, an attacker can insert his own messages into active chats, edit them, and carry out DoS attacks, due to which chat sessions will be urgently terminated.

“Note that we had not seen attackers attempt this specific bypass in our customer data, and do not believe that it was being actively exploited”, — report researchers.

Remediation and Mitigation from Alert Logic

The primary resolution of this vulnerability is to update the plugin to the latest version. If this cannot be achieved, then mitigation options may include:

Virtual patching using a WAF to filter traffic destined for the WP Live Chat Support REST endpoint

Interestingly, in the past month, Sucuri’s specialists discovered another dangerous problem in WP Live Chat Support -XSS bug, which allowed automating attacks on vulnerable sites and introducing malicious code without authentication. Criminals quickly began to exploit this vulnerability.

READ  Alpine’s Docker-images were supplied with empty password of “root” user

Concluding, according to ZScaler ThreatLabZ, attackers injected malicious JavaScript on vulnerable sites, which organized forced redirects and was responsible for arrival of pop-up windows and fake subscriptions.

Source: https://blog.alertlogic.com

[Total: 0    Average: 0/5]

About Trojan Killer

Carry Trojan Killer Portable on your memory stick. Be sure that you’re able to help your PC resist any cyber threats wherever you go.

Check Also

Exim server under attack

Millions of unpatched Exim mail servers are now under active attack

Cybercriminals are now actively attacking mail servers that use Exim for their work to exploit …

Researchers taught Rowhammer to steal data

A team of researchers from the United States, Australia and Austria developed a new version …

Leave a Reply