Polyfill Supply Chain Attack Malicious Code Execution

id: CVE-2024-38526

info:
  name: Polyfill Supply Chain Attack Malicious Code Execution
  author: abut0n
  severity: high
  description: |
    pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io
  impact: |
    The polyfill.io CDN has been sold and now serves malicious code.
  remediation: |
    This issue has been fixed in pdoc 14.5.1.
  reference:
    - https://sansec.io/research/polyfill-supply-chain-attack
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38526
    - https://x.com/triblondon/status/1761852117579427975
    - https://github.com/mitmproxy/pdoc/pull/703
    - https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
    epss-score: 0.03832
    epss-percentile: 0.90186
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate

      - action: waitload

      - action: script
        name: extract
        args:
          code: |
            () => {
             return '\n' + [...new Set(Array.from(document.querySelectorAll('[src], [href], [url], [action]')).map(i => i.src || i.href || i.url || i.action))].join('\r\n') + '\n'
            }

    extractors:
      - type: kval
        part: extract
        name: urls
        internal: true
        kval:
          - extract

    matchers:
      - type: word
        words:
          - "polyfill.io"
          - "bootcdn.net"
          - "bootcss.com"
          - "staticfile.net"
          - "staticfile.org"
          - "unionadjs.com"
          - "xhsbpza.com"
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls