I am getting a JavaScript alert in my project that I didn't create, threatening me?

Question

This morning I woke up to a JavaScript alert on a project of mine that runs KnockoutJS, jQuery, and Underscore.js. It says "I can run any JavaScript of my choice on your users' browsers". The only third-party JavaScript I am downloading is Typekit, and removing that does not make this go away. I've searched my JavaScript and vendor JavaScript and this string does not come back up matching anything.

How would you troubleshoot this and/or is this something that is known to occur?

Answer 1

If you have a database for your application, that would be the next place to check. I'm guessing somebody found and exploited an Injection vulnerability (either un-sanitized HTML input or SQL) and injected the script into a page via the database.

The last place would be to look at the ruby code to see if somehow a malicious user modified your source.

Answer 2

You obviously take an input from user and then outputting it back as part of HTML without quoting or sanitizing. There's two quick checks to do:

1) Open source of page that outputs this alert and search inside source for exact text of alert - this should give you clear indication of what user-filled field is compromised. 2) To be sure, search all other fields in your database generated by users (login names, text of comments, etc.) for words "script" and "alert".

For future: always sanitize your input (remove HTML tags) before inserting it in HTML page OR escape symbols as entities according to standards OR explicitly treat is a plain text by assigning it to value of text node in DOM.