2024-06-27 13:30:06 +00:00
|
|
|
id: polyfill-backdoor
|
2024-06-25 13:36:55 +00:00
|
|
|
|
|
|
|
|
info:
|
2024-07-15 13:18:30 +00:00
|
|
|
name: Polyfill.io - Backdoor
|
2024-06-25 13:36:55 +00:00
|
|
|
author: kazet
|
2024-07-01 08:23:52 +00:00
|
|
|
severity: high
|
2024-06-27 10:46:00 +00:00
|
|
|
description: |
|
|
|
|
|
The polyfill.io CDN was suspected to serve malware.
|
2024-06-25 13:36:55 +00:00
|
|
|
reference:
|
|
|
|
|
- https://sansec.io/research/polyfill-supply-chain-attack
|
|
|
|
|
- https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
|
|
|
|
|
- https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk
|
|
|
|
|
metadata:
|
|
|
|
|
verified: true
|
|
|
|
|
max-request: 1
|
2024-06-27 10:46:00 +00:00
|
|
|
shodan-query: html:"polyfill.io"
|
2024-06-27 13:30:06 +00:00
|
|
|
tags: cdn,polyfill-io,backdoor,malware
|
2024-06-25 13:36:55 +00:00
|
|
|
|
|
|
|
|
http:
|
|
|
|
|
- method: GET
|
|
|
|
|
path:
|
|
|
|
|
- "{{BaseURL}}"
|
|
|
|
|
|
|
|
|
|
redirects: true
|
|
|
|
|
max-redirects: 1
|
|
|
|
|
|
|
|
|
|
matchers-condition: and
|
|
|
|
|
matchers:
|
|
|
|
|
- type: regex
|
|
|
|
|
part: body
|
|
|
|
|
regex:
|
|
|
|
|
- "<script[^>]* src=['\"]https?://([a-zA-Z0-9-]*.)?polyfill.io[/'\"]"
|
2024-07-15 13:18:30 +00:00
|
|
|
# digest: 4a0a0047304502202741c6e8841c555d7c41536c7eccafe5207519fdbe69a21a76d09728e190bc5d022100ac5f13bcb311fa2091c545e60acfa5a45f6b000cdf5e4fd5a46f76d0632f4575:922c64590222798bb761d5b6d8e72950
|
