I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
Specifics:
- It's being detected as a Blackhole exploit kit inside of a Cufon font.
- The exploit adds some Javascript intending to load more Javascript from an off-site URL (Currently down, so no way of further analyzing.)
- The page appears to be flat HTML -- no server-side code at all. This rules out quite a number of attack vectors.
- The only other Javascript on the page is cufon.js, prototype.js and Google Analytics.
To that end:
Is it at all possible to use Cufon.js or Prototype.js to write to the server's filesystem, ultimately using those scripts as an attack vector for Blackhole?
If not, are there any possibilities other than server-level vulnerabilities (SSH/FTP passwords, insecure server configuration, etc.), with maybe the exception of the designer using a compromised pirated font?
Many thanks!