CVE-2025-45960
📋 TL;DR
This Cross-Site Scripting (XSS) vulnerability in tawk.to Live Chat v1.6.1 allows attackers to inject malicious scripts into web pages viewed by other users. The vulnerability affects websites using the vulnerable tawk.to Live Chat plugin, potentially compromising user sessions and data.
💻 Affected Systems
- tawk.to Live Chat
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers could steal user session cookies, redirect users to malicious sites, perform actions on behalf of users, or deface the website.
Likely Case
Session hijacking, credential theft, or malicious redirects affecting users who interact with the chat interface.
If Mitigated
Limited impact with proper Content Security Policy (CSP) headers and input validation in place.
🎯 Exploit Status
Proof of concept available on GitHub. Exploitation requires user interaction with the chat interface.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: http://tawkto.com
Restart Required: No
Instructions:
Check tawk.to website for security updates. Remove or disable the plugin until a patch is available.
🔧 Temporary Workarounds
Implement Content Security Policy
allAdd CSP headers to restrict script execution sources
Add 'Content-Security-Policy: default-src 'self'; script-src 'self'' to HTTP headers
Disable tawk.to Live Chat
allTemporarily disable the vulnerable plugin
Remove or comment out tawk.to script tags from web pages
🧯 If You Can't Patch
- Implement web application firewall (WAF) rules to block XSS payloads
- Monitor for suspicious chat input patterns and block malicious users
🔍 How to Verify
Check if Vulnerable:
Check if tawk.to Live Chat v1.6.1 is installed by reviewing plugin/script versions on web pagesCheck Version:
Inspect webpage source for tawk.to script tags and version informationVerify Fix Applied:
Test chat input fields with XSS payloads like <script>alert('test')</script> and verify they are properly sanitized📡 Detection & Monitoring
Log Indicators:
- Unusual chat input patterns containing script tags or JavaScript code
- Multiple failed XSS attempts in chat logs
Network Indicators:
- HTTP requests containing XSS payloads to chat endpoints
- Unexpected external script loads from chat interactions
SIEM Query:
source="web_logs" AND ("<script>" OR "javascript:" OR "onerror=" OR "onload=") AND uri="*chat*"