Cufon or Prototype as an attack vector for Blackhole exploit kit?

Question

I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.

Specifics:

1. It's being detected as a Blackhole exploit kit inside of a Cufon font.
2. The exploit adds some Javascript intending to load more Javascript from an off-site URL (Currently down, so no way of further analyzing.)
3. The page appears to be flat HTML -- no server-side code at all. This rules out quite a number of attack vectors.
4. The only other Javascript on the page is cufon.js, prototype.js and Google Analytics.

To that end:

1. Is it at all possible to use Cufon.js or Prototype.js to write to the server's filesystem, ultimately using those scripts as an attack vector for Blackhole?

2. If not, are there any possibilities other than server-level vulnerabilities (SSH/FTP passwords, insecure server configuration, etc.), with maybe the exception of the designer using a compromised pirated font?

Many thanks!

Answer 1

As JavaScript runs on the client side, you can't use it to write to the server's filesystem unless the filesystem/server is already compromised. In other words, the attacker already included, for example, a PHP script that will respond to the JavaScript commands and execute them on the server side.

Your first step now is to scan the server for any such dynamic files. Note that there are also other tools such as http://nodejs.org/ and many many others that the attacker might install to conduct additional attacks.

Having done the above, and cleaning up the Cufon font file, I guess you'll be pretty secure.

Final recommendation. Use this awesome security scanner: http://sitecheck.sucuri.net/scanner/

Cheers!