技術解説とコード分析：CVE Teardown: Polyfill.io Supply Chain Hijack (Over 100k Sites Compromised)

vulnerabilidade に関する技術的なソースコード解析と堅牢化対策：脆弱性の根本原因と安全な実装パッチの詳細。

💡 わかりやすい解説 (ELI5)

何千ものレストランが長年同じ信頼できる水の配送業者を利用していた場面を想像してください。元の配達員が引退し、悪質な業者へ密かに権利を売却した途端、新しいドライバーが客席を監視し、特定の客のグラスに偽のカジノ抽選チケットを滑り込ませるようになりました。

主要な概念と専門用語

Dynamic User-Agent Polyfilling: 主要概念 (Dynamic User-Agent Polyfilling)：Serving tailored JavaScript bundles depending on the client's browser headers, making Subresource Integrity (SRI) hashes impossible.
Conditional Payload Evasion: 主要概念 (Conditional Payload Evasion)：Analyzing HTTP Referer, screen size, user-agent, and devtools presence to serve clean scripts to developers while attacking real mobile consumers.
Domain Ownership Transfer Risk: 主要概念 (Domain Ownership Transfer Risk)：The inherent danger of embedding third-party scripts from domains that can be acquired, expired, or transferred without consent.
Subresource Integrity (SRI): 主要概念 (Subresource Integrity (SRI))：A cryptographic browser mechanism that validates script hashes before execution.

根本原因の分析 (Root Cause)

根本原因は、オープンソースシステムにおける未検証の境界パラメータに起因し、状態の非同期化とセキュリティ制御の迂回を可能にします。

ステップ・バイ・ステップの攻撃フロー

Step 1

1. Domain Acquisition

In February 2024, the domain polyfill.io was purchased from its creator by Funnull, an operator associated with casino affiliate marketing.

Step 2

2. User-Agent & Header Filtering

The CDN edge inspected incoming HTTP requests. If the request was from an admin IP, Google bot, or desktop browser with DevTools open, it served normal, benign polyfills.

Step 3

3. Targeted Evasion & Payload Delivery

If the request was from an organic mobile visitor via search referrer, the server appended an obfuscated redirect payload: window.location.href = 'https://kucontent.com/...'.

Step 4

4. Ecosystem Interventions

Cloudflare and Fastly deployed automatic edge URL rewrites to replace polyfill.io with clean mirrors, while Google flagged all sites utilizing the script in search results.

ソースコード比較：脆弱 vs 堅牢化

✕ 脆弱な実装

<!-- VULNERABLE: Direct 3rd-party CDN script without integrity verification -->
<!DOCTYPE html>
<html>
<head>
  <title>Production Web App</title>
  <!-- Polyfill CDN serves arbitrary dynamic code controlled by third party -->
  <script src="https://cdn.polyfill.io/v3/polyfill.min.js?features=default,Array.prototype.flat"></script>
</head>
<body>
  <h1>Welcome</h1>
</body>
</html>

✓ 堅牢化されたセキュアパッチ

<!-- SECURE: Native ES6+ or Self-Hosted Vendored Fallbacks with CSP & SRI -->
<!DOCTYPE html>
<html>
<head>
  <title>Production Web App</title>
  <!-- 1. Modern browsers require no polyfills (99%+ modern baseline) -->
  <!-- 2. For legacy needs, bundle polyfills locally into your build pipeline -->
  <script src="/static/vendor/core-js-bundle.min.js" 
          integrity="sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC" 
          crossorigin="anonymous"></script>

  <!-- 3. Strict Content Security Policy blocking untrusted third-party script sources -->
  <meta http-equiv="Content-Security-Policy" 
        content="default-src 'self'; script-src 'self' 'sha384-oqVuAfXRKap7fdgcCY5uykM6+R9GqQ8K/uxy9rx7HNQlGYl1kPzQho1wx4JwY8wC';">
</head>
<body>
  <h1>Welcome</h1>
</body>
</html>

エンジニアリング＆システム堅牢化チェックリスト

✓決して load third-party scripts from public CDNs into production applications without Subresource Integrity (SRI) hashes しないでください。
✓推奨されるセキュリティ対策：Vendor all runtime polyfills and libraries directly into your application bundle via npm/yarn/pnpm lockfiles。
✓a strict Content Security Policy (CSP) with script-src 'self' to prevent unauthorized script injections を強制適用してください。
✓all domain assets periodically to ensure embedded hosts have not lapsed or transferred ownership を詳細に監査してください。