CVE-2021-24914 Tawk.to Live Chat < 0.6.0 - Subscriber+ Visitor Monitoring & Chat Removal
Low-privileged users can modify or remove the live chat widget, allowing them to monitor visitors and inject arbitrary content due to missing capability checks.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2021-24914?
CVE-2021-24914 is a high-severity missing authorization vulnerability in Unknown Tawk.To Live Chat, published on 6 Dec 2021. Any signed-in user can exploit it over the network, and only if a user opens a file or follows a link.
Official description
The Tawk.To Live Chat WordPress plugin before 0.6.0 does not have capability and CSRF checks in the tawkto_setwidget and tawkto_removewidget AJAX actions, available to any authenticated user. The first one allows low-privileged users (including simple subscribers) to change the 'tawkto-embed-widget-page-id' and 'tawkto-embed-widget-widget-id' parameters. Any authenticated user can thus link the vulnerable website to their own Tawk.to instance. Consequently, they will be able to monitor the vulnerable website and interact with its visitors (receive contact messages, answer, ...). They will also be able to display an arbitrary Knowledge Base. The second one will remove the live chat widget from pages.
Which versions are affected by CVE-2021-24914?
It affects 1 product.
Products include Tawk Tawk.to Live Chat.
How do I fix CVE-2021-24914?
No fix has been published for CVE-2021-24914 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2021-24914 being exploited?
There is no known exploitation of CVE-2021-24914 in the wild and no public exploit code.
Sources
Also known as GHSA-q4qq-c8pp-p3rp.