What could cause a undefinedpageWebRequestEvents.js appearing in my logs?

Question

We're seeing this extremely rare, extremely odd bug in our logs. When some people (I believe most are on Safari) are trying to access various pages on our site, they get an error and can't proceed. When I check the logs, I see URLs with undefinedpageWebRequestEvents.js in them.

I've searched around but can't seem to find any explanation of what this might be or what might be causing them. There is VERY little javascript on this site, and hundreds of thousands of others are not seeing this error (including us - we cannot duplicate) so any advice is appreciated.

Answer 1

The Firefox LastPass extension has this string as part of onloadwff.js:

t.src=bg.get("extensionBaseURL")+"pageWebRequestEvents.js"

If the bg.get("extensionBaseURL") statement returns undefined, your mystery url would be injected into a script tag on the page. Firefox does not appear to list local files loaded by an extension in the Network tab, but you should be able to track down the references the same way I did:

1. Install the extension. (LastPass Firefox Toolbar 4.1.53)
2. Load the Dev Tools' "Debugger" pane and visit a webpage.
3. Under "Sources," you should be able to see a data/pageWebRequestEvents.js file under [email protected].
4. I searched for references to it with cmd+P and typing !pageweb into the search box (! for "In All Files").
5. The references that appear are on lines that are too long to click on, but they're clearly in the data/onloadwff.js file.
6. Either copy that file and search through it in your favorite text editor, or load it in the Debugger tab and use the local file search (#pageweb third result).

This may also happen with Safari, but I don't know how to crack open a Safari extension's resources.

Answer 2

It looks like this could be related to an infected lastpass_x64.exe - the strings extracted from that file include reference to a "pageWebRequestEvents.js". I am in no way affiliated with hybrid-analysis.com, so I can't tell whether their analysis is legit or sane.

For what it's worth I've seen two instances of this file being requested in the last 24 hours.