CVE-2021-43353 in Crisp Live Chat Plugin
Summary
by MITRE • 01/18/2022
The Crisp Live Chat WordPress plugin is vulnerable to Cross-Site Request Forgery due to missing nonce validation via the crisp_plugin_settings_page function found in the ~/crisp.php file, which made it possible for attackers to inject arbitrary web scripts in versions up to, and including 0.31.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 02/14/2025
The CVE-2021-43353 vulnerability represents a critical cross-site request forgery weakness in the Crisp Live Chat WordPress plugin, exposing systems to arbitrary script injection attacks. This vulnerability exists within the crisp_plugin_settings_page function located in the main plugin file at ~/crisp.php, where the absence of proper nonce validation creates a significant security gap. The flaw affects all versions up to and including 0.31, making it a widespread concern for WordPress installations utilizing this plugin. The vulnerability stems from the plugin's failure to implement proper request verification mechanisms that would normally prevent unauthorized modifications to plugin settings through forged requests.
The technical implementation of this CSRF vulnerability allows attackers to exploit the missing nonce validation by crafting malicious requests that appear to originate from legitimate administrative users. When an authenticated administrator visits a compromised page or clicks on a malicious link, the attacker can manipulate the plugin's settings without proper authorization. This occurs because the plugin does not validate the authenticity of requests through the standard WordPress nonce system, which is designed to prevent CSRF attacks by ensuring that requests are intentionally submitted by authorized users. The vulnerability directly violates the principle of least privilege and proper input validation that should be enforced in all web applications handling administrative functions.
The operational impact of this vulnerability extends beyond simple script injection, as it enables attackers to modify plugin configurations, potentially leading to more severe consequences including data exfiltration, service disruption, or establishment of persistent backdoors. An attacker could modify chat settings to redirect user conversations to malicious endpoints, inject malicious JavaScript into chat interfaces, or alter authentication mechanisms within the plugin. This vulnerability also creates opportunities for attackers to escalate privileges within the WordPress environment, as compromised plugin settings may provide access to other system components or user data. The attack vector is particularly dangerous because it requires minimal user interaction, often relying on social engineering techniques to convince administrators to visit malicious pages while authenticated.
Organizations affected by this vulnerability should immediately implement mitigations including updating to the latest plugin version where the nonce validation has been properly implemented. The fix should follow established security practices such as implementing WordPress nonce validation for all administrative actions and ensuring that all user-initiated modifications require proper authentication tokens. Security teams should also conduct comprehensive vulnerability assessments to identify any potential exploitation attempts and monitor for unusual administrative activities in WordPress logs. Additionally, implementing network-based security controls such as web application firewalls and access control policies can provide additional layers of protection. This vulnerability aligns with CWE-352, which specifically addresses cross-site request forgery weaknesses, and represents a clear violation of the ATT&CK technique T1059.007 for command and scripting interpreter, as attackers can leverage this vulnerability to execute malicious scripts within the target environment.