flawopen.com/Teardowns/polyfill-io-supply-chain-hijack

● CVE-2024-0000 · CVSS 9.8 · Kritis
Riset Keamanan · FlawOpen

CVE Teardown: Polyfill.io Supply Chain Hijack (Over 100k Sites Compromised)

Analisis teknis mendalam dan mitigasi rekayasa sistem untuk vulnerabilidade: How the acquisition of the popular polyfill.io domain by a gambling/redirect syndicate turned a ubiquitous frontend CDN into a stealthy, conditional malware injector.

💡 Penjelasan Sederhana (ELI5)

Bayangkan ribuan restoran menggunakan jasa kurir air minum tepercaya yang sama selama bertahun-tahun. Ketika kurir asli pensiun dan diam-diam menjual rutenya ke pesaing nakal, pengemudi baru mulai memeriksa meja dan menyelipkan tiket lotere palsu ke dalam minuman pelanggan tertentu.

Konsep Kunci & Istilah

Dynamic User-Agent Polyfilling
Menyajikan bundel JavaScript yang disesuaikan bergantung pada header browser klien, membuat hash Subresource Integrity (SRI) menjadi mustahil.
Conditional Payload Evasion
Menganalisis Referer HTTP, ukuran layar, user-agent, dan alat pengembang untuk memberikan skrip bersih kepada pengembang sambil menyerang pengguna seluler yang sebenarnya.
Domain Ownership Transfer Risk
Bahaya bawaan dari menyematkan skrip pihak ketiga dari domain yang dapat diperoleh, kedaluwarsa, atau ditransfer tanpa persetujuan.
Subresource Integrity (SRI)
Mekanisme kriptografi browser yang memvalidasi hash skrip sebelum dieksekusi.

Analisis Akar Masalah (Root Cause)

Akar masalah bermula dari parameter batas yang tidak divalidasi pada sistem open source, yang memungkinkan desinkronisasi status dan bypass kontrol keamanan.

Alur Serangan Langkah demi Langkah

Step 1

1. Domain Acquisition

In February 2024, the domain polyfill.io was purchased from its creator by Funnull, an operator associated with casino affiliate marketing.

Step 2

2. User-Agent & Header Filtering

The CDN edge inspected incoming HTTP requests. If the request was from an admin IP, Google bot, or desktop browser with DevTools open, it served normal, benign polyfills.

Step 3

3. Targeted Evasion & Payload Delivery

If the request was from an organic mobile visitor via search referrer, the server appended an obfuscated redirect payload: window.location.href = 'https://kucontent.com/...'.

Step 4

4. Ecosystem Interventions

Cloudflare and Fastly deployed automatic edge URL rewrites to replace polyfill.io with clean mirrors, while Google flagged all sites utilizing the script in search results.

Kode Sumber: Rentan vs Aman

✕ IMPLEMENTASI RENTAN
<!-- VULNERABLE: Direct 3rd-party CDN script without integrity verification -->
<!DOCTYPE html>
<html>
<head>
  <title>Production Web App</title>
  <!-- Polyfill CDN serves arbitrary dynamic code controlled by third party -->
  <script src="https://cdn.polyfill.io/v3/polyfill.min.js?features=default,Array.prototype.flat"></script>
</head>
<body>
  <h1>Welcome</h1>
</body>
</html>
✓ PERBAIKAN AMAN & KUAT
<!-- SECURE: Native ES6+ or Self-Hosted Vendored Fallbacks with CSP & SRI -->
<!DOCTYPE html>
<html>
<head>
  <title>Production Web App</title>
  <!-- 1. Modern browsers require no polyfills (99%+ modern baseline) -->
  <!-- 2. For legacy needs, bundle polyfills locally into your build pipeline -->
  <script src="/static/vendor/core-js-bundle.min.js" 
          integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
          crossorigin="anonymous"></script>

  <!-- 3. Strict Content Security Policy blocking untrusted third-party script sources -->
  <meta http-equiv="Content-Security-Policy" 
        content="default-src 'self'; script-src 'self' 'sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC';">
</head>
<body>
  <h1>Welcome</h1>
</body>
</html>

Daftar Periksa Penguatan Sistem Rekayasa