I've been asked to look into the security of a client site that's apparently throwing antiviral messages when visited.
- It's being detected as a Blackhole exploit kit inside of a Cufon font.
- The page appears to be flat HTML -- no server-side code at all. This rules out quite a number of attack vectors.
To that end:
Is it at all possible to use Cufon.js or Prototype.js to write to the server's filesystem, ultimately using those scripts as an attack vector for Blackhole?
If not, are there any possibilities other than server-level vulnerabilities (SSH/FTP passwords, insecure server configuration, etc.), with maybe the exception of the designer using a compromised pirated font?