CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
29.0%
The polyfill.js is a popular open-source library that helps older browsers support functionality in newer browsers. Thousands of sites embed it using the cdn[.]polyfill[.]io domain. In February 2024, a Chinese company (Funnull) bought the domain and the GitHub account. The company has modified Polyfill.js so malicious code would be inserted into websites that embedded scripts from cdn.polyfill[.]io. Any script adopted from cdn.polyfill[.]io would immediately download malicious code from the Chinese company's site. Some of the known outcomes that result in supply chain attack are:
Given that modern browsers do not require Polyfill, the original Polyfill author, Andrew Betts, recommends not to use Polyfill at all. All websites should remove any references to polyfill.io. Recommended alternatives are CDN such as Cloudflare and Fastly.
Impacted Domains:
The extent of damage is hard to quantify. Listed below are a subset of indicators to watch out for in your organization if your site is compromised:
Notifications and warnings were ignored, the complaints on GitHub were removed, and the altered script continued to redirect users to malicious sites.
Qualys provides a comprehensive continuous solution to detect security issues in organizations. You can discover all your applications in your organization using CSAM to ensure all the assets are scanned. Given the nature of the attacks possible, we highly recommend organizations to launch VM, WAS and Web Malware scans to detect and remove the usage of scripts from the polyfill.io and impacted domains. The detection of your website being compromised is possible by launching a Web Malware scan.
Qualys had existing QIDs that would have informed you of the possibility of the attack. Qualys has kept up with the research and released multiple detections to detect the usage of malicious domains and sites that have been compromised. If your scans report any of the following QIDs, please immediately follow the preventive measures we have provided in your reports.
QID:152105: Javascript in pdoc uses polyfill.io (CVE-2024-38526)
QID 152102: Malicious Polyfill.io Detected
QID 150261: Subresource Integrity (SRI) Not Implemented
In anticipation of events such as these Qualys research had released a Subresource Integrity check in 2020.
If you see this IG QID reported, please ensure you take precautions to include integrity attribute to all elements that load external content.
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
LOW
Integrity Impact
NONE
Availability Impact
LOW
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
AI Score
Confidence
High
EPSS
Percentile
29.0%