id: polyfill-backdoor

info:
  name: Polyfill.io - Backdoor
  author: kazet
  severity: info
  description: |
    The polyfill.io CDN was suspected to serve malware. Note: it's not exploitable anymore
  reference:
    - https://sansec.io/research/polyfill-supply-chain-attack
    - https://web.archive.org/web/20240229113710/https://github.com/polyfillpolyfill/polyfill-service/issues/2834
    - https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk
  metadata:
    verified: true
    max-request: 1
    shodan-query: html:"polyfill.io"
  tags: cdn,polyfill-io,backdoor,malware

http:
  - method: GET
    path:
      - "{{BaseURL}}"

    redirects: true
    max-redirects: 1

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "<script[^>]* src=['\"]https?://([a-zA-Z0-9-]*.)?polyfill.io[/'\"]"
# digest: 4a0a0047304502204dd739a9cbd81f5bc54e9e8a6e52c97be8be5d7a72052000469a5802d9e37502022100fffc5b40c2c09747f4361e682c21d59b2420e96b1e89693abd29a90337369929:922c64590222798bb761d5b6d8e72950