-1

EDIT: The script has been removed and apparently the vulnerability has been patched.

My employer links to this resource:

http://www.myplan.com/

I recently noticed a JavaScript alert was added into to main landing page: "31337"

More likely bored, soon to be fired programmer or malicious attacker?

In either case is there anything I should do about it?

  • 3
    If you just browse the site without entering any sensitive data into it nor do you have an account there, I wouldn't worry about it. They have contact email addresses on their "about us" page, you could tell them they got compromised if you want to be nice. – user42178 May 5 '15 at 18:24
  • 1
    Are you sure it was a XSS problem? Could the coder have placed an alert for testing purposes? It's bad form, but lots of devs test problems in production. – schroeder May 5 '15 at 18:58
  • 1
    @Neil It can be in the page source and still be an XSS attack. This class of attacks is known as persistent XSS attacks – limbenjamin May 5 '15 at 19:19
  • Good point @limbenjamin. Deleted my prior comment. – Neil Smithline May 5 '15 at 19:22
  • 1
    @André maybe for a 0day, but maybe there was other malicious code? My point is that just stating "your fine because you didn't enter any data" is too limited. – Lucas Kauffman May 5 '15 at 20:32
5

It's in the page source, nested in an HTML table cell as:

<td width="194" height="34" class="poll_row_border" style="padding-left:4px;"><div align="right" class="tool_description">
                    "><ScRipT>alert(31337)</ScrIpT>                </div></td>

Interestingly, there are two sets of similar code that contain this further down in the page source that also contain the Javascript code. This indicates to me that several revisions to the site have been made with that code in place. However, according to the WayBackMachine (http://web.archive.org/web/20150315142223/http://www.myplan.com/), the source on March 14th does NOT contain this Javascript.

As mentioned in the comments, this can still be an XSS attack called a persistent XSS attack since it is lodged in the actual source code. This also isn't a security risk for you if you have no sensitive info stored at that site... for now. If this is the product of an exploited XSS hole, it is acting as a beacon calling attention to any hackers browsing the site, letting them know that a vulnerability exists. If they can find and exploit it with intent to implement a 0-day or malicious redirect, this affects you and your users.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.