id: lottie-backdoor

info:
  name: Lottie Player - Backdoor
  author: nagli-wiz
  severity: critical
  description: |
    Detectes vulnerable compormised version of lottie-player JS Library that were compormised with a Web3 wallet pop-up backdoor.
  reference:
    - https://github.com/LottieFiles/lottie-player/issues/254
    - https://x.com/galnagli/status/1851779972639363076
  tags: cdn,lottie-player,backdoor,malware

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 1

    matchers:
      - type: word
        words:
          - 'lottie-player@2.0.5'
          - 'lottie-player@2.0.6'
          - 'lottie-player@2.0.7'
# digest: 4a0a00473045022100f2b7d007d2c50590cc22781b5170e803b0170878c1fb5169763ca3af19ca8b6a02200542484037342268b62b32292df01c39739846377153f7fb72a61c22a63dc545:922c64590222798bb761d5b6d8e72950