2

I'm seeing a very weird attack this morning from a pile of VPS instances spread out across the US. The URLs look like this:

  • /js/bundles/,!0):this.element.propAttr(
  • /js/bundles/&this.buttons.button(
  • /js/bundles/),this===i&n(this).addClass(
  • /js/bundles/)&!t.input.is(
  • /js/bundles/&(f=i.end-i.start==0?0:(i.now-i.start)/(i.end-i.start));t.toShow[0].style[i.prop]=f*u[i.prop].value+u[i.prop].unit},duration:t.duration,easing:t.easing,complete:function(){t.autoHeight||t.toShow.css(

What on earth are those ,!0): and & supposed to do? I can't imagine that that would say anything effectively malicious to a server, unless this is exploiting some egregious server bug or the intended victim is not the server at all.

There seem to be a wide spread of environments for these bots -- some of them are XP, some are Vista, some are Windows 7. I've seen IE7, 8, and 9, as well as Chrome and Safari. I even saw an LG feature phone that said it was running Windows NT 5.1 and IE8. None of them have any referrer URLs, so I can't figure out what page they previously viewed on our site.

(/js/bundles is where we keep our bundled assets, by the way.)

My question is: does anyone know what (server, browser, etc) these attacks are meant to exploit? They seem to be attempts at XSS exploits, but they're not very well-formed. ASP.NET seems to be catching them, though, so I'm not too worried.

(Another possibility is that they're just a really buggy spider doing its thing.)

  • Are you certain this is an attack? Do these requests coincide with increased usage of any particular page or a new feature? Did you upgrade to jquery 2.0 recently? – Andrew Hoffman Nov 26 '14 at 19:21
  • Are there any IE 6/7/8 sessions that don't have these improperly formatted requests? – Andrew Hoffman Nov 26 '14 at 19:28
  • 1
    I'm not certain this is an attack, but I just find it odd that they all happened in a window of about half an hour and all the IP addresses resolved to VPS and colocation facilities. – Paul d'Aoust Nov 26 '14 at 19:39
  • @AndrewHoffman we're still on jQuery 1.8 because we have a lot of IE8 customers. It looks like our package manager took the liberty of dropping jQuery 2.0 in our application path, but no pages actually reference it. – Paul d'Aoust Nov 26 '14 at 19:41
  • 2
    What I find really odd is that all the snippets that are being tacked onto the URL are all chunks of the minimised jQuery UI codebase. Maybe it's just a really buggy distributed spider. – Paul d'Aoust Nov 26 '14 at 19:59
2

Those URLs look a lot like a buggy crawler and very little like an exploit attempt.

A properly formatted hyperlink will start something like <a href="some-url">. The interesting part is what is between the " characters. A lazy coder might just look for pairs of " characters and not pay attention to the context at all.

Depending on the structure of the URL, it may be an absolute or a relative URL. I have seen plenty of examples of crawlers incorrectly using an absolute URL as if it was a relative URL. That's another example of how they may get URLs wrong, though I'm not sure if that part applies to your case.

If /js/bundles/ contained a link looking like <a href=",!0):this.element.propAttr(">, that might be interpreted as a relative link pointing to /js/bundles/,!0):this.element.propAttr(. Of course the file didn't contain a link looking exactly like that, but it may have contained the sub string ",!0):this.element.propAttr(", and to a lazy crawler only looking for " characters those two would be the same.

For each of the code fragments in your example you can ask yourself, is it realistic that this would have been found in a context where it was surrounded by " chars. I think it is.

The reason I think it looks very little like an exploit attempt is that those fragments of code could not be executed on their own. If you were to actually try running that code, you'd get syntax errors because parts were missing. Actual exploit attempts usually contains some piece of code, but they contain enough code that the code could actually execute.

0

Considering that these are static resources I don't think these are attacks. I have no idea what it could possibly be... this suggestion doesn't even make sense, but maybe a random syntax of parameters that prevent server side caching. Maybe certain crawlers use this. It's weird because it's not even requesting specific files in the directory it looks like.

Edit:

Maybe they are attacks aimed at a node.js server. These are written in javascript..?

  • Thanks for the feedback -- which suggestion were you referring to when you said 'the suggestion doesn't even make sense'? I like the possibility of it being randomness that prevents caching. – Paul d'Aoust Nov 26 '14 at 22:00
  • That's the one I was referring to because I thought why would you complicate by making your randoms javascript and possibly risking firewalls blocking your requests – Pim de Witte Nov 26 '14 at 22:11

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.