Polyfill Supply Chain Attack: Details and Fixes  ## Metadata - Author: [[Mars Groves]] - Full Title: Polyfill Supply Chain Attack: Details and Fixes - Category: #articles - Document Note: --- tags: [#cybersecurity, #supplychain, #open-source, #JavaScript] Author: Mars Groves Source: FOSSA Blog Reference: [Polyfill Supply Chain Attack: Details and Fixes](https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/) date created: 2024-10-14 09:30 --- # Title: Polyfill Supply Chain Attack: Details and Fixes ## Table of Contents: - [📝 Summary](#-summary) - [📖 Main Content](#-main-content) - [🗒️ Notes](#️-notes) - [🗣️ Paraphrase](#-paraphrase) - [📰 Newsletter](#-newsletter) - [✅ Action Items](#-action-items) - [🧪 Hypotheses](#-hypotheses) - [📊 Methodology](#-methodology) - [❓ Questions](#-questions) - [🔮 Future Research](#-future-research) - [💡 Implications](#-implications) - [🧠 Learning Styles Assessment](#-learning-styles-assessment) - [📊 Accessibility Assessment](#-accessibility-assessment) - [🌍 DEIB Assessment](#-deib-diversity-equity-inclusion-and-belonging-assessment) - [✅ Logical Validity](#-logical-validity) - [🔍 SEO Evaluation](#-seo-evaluation) - [🎯 Conclusion](#-conclusion) ## 📝 Summary: The Polyfill supply chain attack occurred after Funnull acquired the domain of the Polyfill.io CDN, injecting malicious scripts into websites. This JavaScript attack impacted thousands of sites, exploiting users by injecting malware or redirecting mobile visitors to phishing pages. Security mitigations included removing the malicious CDN references and replacing them with safer mirrors. ## 📖 Main Content: This attack emphasizes the risks posed by compromised third-party services, especially within the open-source ecosystem. Funnull exploited a trusted JavaScript resource by injecting malicious code that only executed under specific conditions, making it harder to detect. The attack raises awareness about the importance of vigilant content security policies (CSP) and subresource integrity (SRI). ### 🗒️ Notes: - **Compromised Resource**: Polyfill.io’s domain and scripts were acquired and altered by Funnull. - **Execution Scope**: Scripts ran primarily on mobile devices to evade detection. - **Mitigation Measures**: Safe mirrors were introduced by Google, Cloudflare, and Fastly. - **Preventive Actions**: Website administrators urged to implement CSPs and SRI to protect against similar attacks. ## 📖 References: - FOSSA Blog: [Full Article](https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/) ## 🗣️ Paraphrase: 1. Funnull’s acquisition of Polyfill.io's domain led to malicious script injections, affecting websites relying on the CDN. 2. Despite efforts to remove the compromised CDN references, over 380,000 websites remained vulnerable, highlighting the need for proactive security management. ## 📰 Newsletter: In this week’s newsletter: Learn how the recent Polyfill supply chain attack compromised thousands of websites and what developers can do to secure their projects. We’ll also cover community meetups and highlight new tools to improve CSP and SRI implementation—key to preventing future vulnerabilities. Keep your open-source projects safe and up-to-date! ## ✅ Action Items: - **Educational Alignment**: This incident reinforces the need for community education on supply chain security. - **OSPO Relevance**: Aligns with your focus on fostering safer open-source practices and preparing for OSPO leadership. ## 🧪 Hypotheses: - Increased adoption of SRI would significantly reduce supply chain vulnerabilities. - Awareness campaigns can drive better third-party dependency management practices. ### 📊 Methodology: - **Surveys**: Assess developer awareness of SRI and CSP practices. - **Log Analysis**: Track the spread of compromised scripts across impacted domains. ### ❓ Questions: - How can open-source projects encourage safer dependency management? - What policies can prevent unauthorized acquisition of critical domains? ### 🔮 Future Research: - Explore the role of SRI adoption across various industries. - Investigate the effectiveness of safe mirrors in minimizing damage from compromised CDNs. ### 💡 Implications: Improving dependency management practices and awareness can minimize future attacks, fostering a more secure open-source ecosystem. ### 🧠 Learning Styles Assessment: - **Visual Learners**: Could benefit from flowcharts outlining the attack. - **Logical Learners**: Incorporate data on the spread and impact of compromised scripts. ### 📊 Accessibility Assessment: - **Screen Reader Compatibility**: Ensure CSP implementation guides are fully accessible. - **Keyboard Navigation**: Provide interactive security tools with full keyboard accessibility. ### 🌍 DEIB Assessment: - **Inclusive Language**: Maintain neutral, accessible language when discussing security practices. - **Cultural Relevance**: Include case studies from diverse regions to highlight global security challenges. ### ✅ Logical Validity: - **Sound Reasoning**: Demonstrates clear cause-and-effect relationships between compromised dependencies and the spread of malicious scripts. - **Fallacy Alert**: Some reliance on appeals to fear could weaken the argument’s objective tone. ### 🔍 SEO Evaluation: - **Keywords**: Polyfill, supply chain attack, CSP, SRI, security vulnerability. - **Meta Description**: Ensure the summary includes key phrases like “Polyfill supply chain attack” for visibility. ## 🎯 Conclusion: This attack highlights the importance of vigilant dependency management and proactive security measures. It underscores the need for developers to adopt best practices, such as SRI, to safeguard their projects from malicious third-party disruptions. - Document Tags: [[cybersecurity]] [[open source]] [[polyfill]] [[security]] - Summary: Get an overview of the polyfill supply chain attack, including how the exploit works and steps to mitigate it. - URL: https://fossa.com/blog/polyfill-supply-chain-attack-details-fixes/ Visual representing a security vulnerability Early in February 2024, a massive supply chain attack occurred after the company Funnull acquired the domain of the popular Polyfill CDN service (`polyfill.io`) and its associated GitHub account. Polyfill is a widely used JavaScript library that ensures compatibility of modern JavaScript features in older browsers, such as screen resolution handling and media queries. Soon after ownership changed hands, the domain began injecting malicious JavaScript code into over 110,000 websites that embedded scripts from `cdn.polyfill.io`. These sites, which included phishing and malicious advertising sites, impacted mobile devices by redirecting them to various scam sites. Several libraries and domains beyond `cdn.polyfill.io` were impacted. This suspicious behavior led to [security researchers at Sansec](https://sansec.io/research/polyfill-supply-chain-attack) discovering the severe vulnerability on June 25, 2024. Additionally, CVE-2024-38526 (which affects the [pdoc package](https://observer.fossa.com/package/pdoc), has been published in connection with the vulnerability. The vulnerability is considered a serious threat because it involves malicious code injection that redirects users to harmful sites or downloads malicious files. This type of attack can lead to data theft, malware distribution, and unauthorized access to sensitive information. In this blog, we will cover an in-depth overview of the polyfill supply chain vulnerability, how it works, remediation strategies, similar case studies, and how to use FOSSA’s tools to detect and mitigate such vulnerabilities. [****Fix Vulnerabilities in Your Open Source: FOSSA's Enhanced Free Tier****](https://app.fossa.com/auth/register?utm_source=fossa&utm_medium=blog) #### Polyfill Vulnerability Background and Impact After Funnull bought the domain, Andrew Betts, the original developer of Polyfill.io, [warned users against using the service](https://x.com/triblondon/status/1761852117579427975). Betts had no control over the domain's new ownership and suspected potential foul play. His suspicions were echoed by developers, such as [Amy Blankenship on LinkedIn](https://www.linkedin.com/pulse/its-time-stop-using-polyfillio-from-cdn-amy-blankenship-n8z7c/), who also urged others to stop using Polyfill.io from CDN. The exploit primarily impacts websites embedding scripts from cdn.polyfill.io and other associated domains such as bootcdn.net, bootcss.com, staticfile.net, staticfile.org, unionadjs.com, xhsbpza.com, union.macoms.la, and newcrbpc.com. Environments utilizing these scripts, especially those not implementing strict [content security policies (CSPs)](https://developer.mozilla.org/en-US/docs/Web/HTTP/CSP) or [subresource integrity (SRI)](https://developer.mozilla.org/en-US/docs/Web/Security/Subresource_Integrity), are vulnerable. Websites using secure mirrors or alternative polyfill libraries are not impacted. #### How the Polyfill Supply Chain Attack Works The Polyfill supply chain attack begins when a user visits a website that relies on the Polyfill service. This service was traditionally used to ensure older browsers could support modern JavaScript functionalities by requesting the `polyfill.js` file from `cdn.polyfill.io`. However, after Funnull acquired the domain, the code was tampered with and embedded with malicious scripts. Here’s a breakdown of how the attack unfolds: 1. Initial request: When a user visits a website that utilizes Polyfill, the site requests the `polyfill.js` file from `cdn.polyfill.io` to enhance browser compatibility. 2. Code modification: Unfortunately, under Funnull's control, this JavaScript file has been altered to contain malicious code. 3. Malware injection: As the compromised script is loaded from `cdn.polyfill.io`, it is loaded into the context of the website, without the website owner’s knowledge. 4. Execution of compromised script: Once the user's browser loads the compromised page, it executes the malicious `polyfill.js` script, giving the malicious script access to any data on that page or any data that is accessible from the context of that page. ##### How the Malicious Code Avoids Detection The malicious code in the Polyfill.io vulnerability is cunningly designed to trigger only under specific conditions, particularly when accessed from mobile devices. This stealthy behavior allows it to evade detection by not executing when web analytics tools are present or when an admin user is logged in, making it challenging for security systems and website administrators to catch. Additionally, the code cleverly adapts to its environment by dynamically generating payloads based on the HTTP headers it receives, tailoring its attack methods to the situation at hand. This adaptability makes the code especially dangerous as it can modify its approach based on the context in which it operates. #### List of Impacted Libraries and Domains Impacted libraries and domains beyond cdn.polyfill.io, include: * `bootcdn.net` * `bootcss.com` * `staticfile.net` * `staticfile.org` * `unionadjs.com` * `xhsbpza.com` * `union.macoms.la` * `newcrbpc.com` Additionally, indicators of compromise (IoCs) for checking in logs include: * `https://www.googie-anaiytics.com/html/checkcachehw.js` * `https://www.googie-anaiytics.com/ga.js` * `https://cdn.bootcss.com/highlight.js/9.7.0/highlight.min.js` * `https://newcrbpc.com/redirect?from=bscbc` * `https://kuurza.com/redirect?from=bitget` * `https://union.macoms.la/jquery.min-4.0.2.js` #### Polyfill Mitigation and Responses On June 27, 2024, security researchers reported the malicious use of the Polyfill.io domain to Namecheap. Immediately after receiving these reports, [Namecheap announced it had removed the Polyfill.io domain](https://x.com/namecheap/status/1806423413151457685?s=42) due to the injection of malicious JavaScript code into websites. Additionally, Cloudflare, Google, and Fastly mitigated the impact by providing safe mirrors for the scripts to prevent further exploitation. Google also took proactive steps by informing advertisers about the possible contamination of their landing pages with malicious scripts and urging them to remove any references to `cdn.polyfill.io` to prevent further risks. This highlights the serious nature of the attack and the necessity for ongoing vigilance in monitoring and updating third-party scripts. Despite these measures, [new findings from Censys](https://www.securityweek.com/over-380k-hosts-still-referencing-malicious-polyfill-domain-censys/) revealed that more than 380,000 hosts were still embedding the malicious Polyfill script as of July 2, 2024. It is unclear exactly how much damage has been done, but the extensive use of the compromised script indicates a potentially significant impact. ##### Finding and Fixing the Polyfill Supply Chain Attack FOSSA customers can determine whether they’re using the `pdoc` package and are impacted by the Polyfill CVE CVE-2024-38526 in several ways. 1. Use our Package Index feature: Navigate to Package Index, search for “CVE-2024-38526,” and any impacted packages or projects will appear in the search results. 2. Use Global Security Issues and search for the CVE. 3. Use Package Index to search for `pdoc`, the package affected by the CVE. It will show in the results if it exists within your environment. You can then action on the package and project based on the results. Doing a version bump to `pdoc 14.5.1` will generally be a recommended course of action. Alternatively, if you’re using Polyfill.io directly, make sure to remove references to `cdn.polyfill.io` from your website. You can choose to replace them with safe mirrors (from Google, Cloudfare, and Fastly) referenced in the previous section. Feel free to [reach out to our team](https://fossa.com/request-demo) for more information about how [FOSSA Vulnerability Management](https://fossa.com/product/open-source-vulnerability-management) can help your organization manage [software supply chain security](https://fossa.com/learn/software-supply-chain-security). *Editor's Note: FOSSA's Product Team also contributed to this article.*, Polyfill Supply Chain Attack: Details and Fixes, Mars Groves, 01ja3sf61nqfte66jcyp72vqd2.