CVE-2024-38526

Executive Summary

CVE-2024-38526 is a supply chain vulnerability in the Python documentation tool pdoc. When generating documentation with the --math flag, pdoc would embed a <script> tag that loaded JavaScript from the polyfill.io CDN. The polyfill.io domain was sold to a new owner who began serving malicious code, turning this into a widespread supply chain attack. Any user visiting generated documentation that included the math feature would execute attacker-controlled JavaScript, potentially leading to data exfiltration, session hijacking, or further compromise.

Supply Chain & Package Security

This vulnerability is a classic supply chain attack targeting the Python ecosystem. The polyfill.io CDN was a trusted third-party resource, but after its sale, it became a vector for malicious code injection. The fix in pdoc 14.5.1 removes the dependency on polyfill.io entirely, replacing it with a self-hosted or alternative solution. Users of pdoc must upgrade to 14.5.1 or later to eliminate this risk. Additionally, any projects that generated documentation with --math prior to the fix should regenerate and redeploy their documentation.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
• Base Score: 7.2 (High)
• Attack Vector: Network
• Attack Complexity: Low
• Privileges Required: None
• User Interaction: None
• Scope: Changed
• Confidentiality Impact: Low
• Integrity Impact: None
• Availability Impact: Low

The high score reflects the ease of exploitation (no user interaction required) and the potential for widespread impact due to the supply chain nature. The malicious code could be served to any visitor of the generated documentation.

Deep Dive & Mechanics

The vulnerability is rooted in pdoc's use of the polyfill.io CDN to provide polyfills for older browsers when the --math flag is used. The generated HTML documentation would include a <script> tag like:

<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>

After the sale of polyfill.io, the CDN began serving malicious JavaScript that could:

• Steal cookies and session tokens
• Redirect users to phishing sites
• Inject cryptocurrency miners
• Perform data exfiltration

The attack is triggered simply by visiting the compromised documentation page. No user interaction beyond page load is required.

Vulnerable vs. Patched Code

Vulnerable (pdoc < 14.5.1):

# In pdoc's template or generation code
<script src="https://polyfill.io/v3/polyfill.min.js?features=es6"></script>

Patched (pdoc 14.5.1):

# The polyfill.io CDN is removed entirely
# Math rendering is handled locally or via a trusted CDN

The fix involves removing the polyfill.io dependency and using a self-hosted or alternative polyfill solution.

Exploitation & Lab Setup

Red Team

1. Setup a malicious polyfill.io clone: Use a tool like evilginx2 or a custom server to mimic the polyfill.io CDN.
2. Generate pdoc documentation with --math: Run pdoc --math my_module -o docs/ to create vulnerable documentation.
3. Host the documentation: Serve the generated HTML on a web server.
4. Wait for victims: Any user visiting the documentation will execute the malicious script.

Example exploit setup:

# Generate vulnerable documentation
pdoc --math my_module -o docs/

# Serve it (e.g., with Python's HTTP server)
python3 -m http.server 8080 --directory docs/

Blue Team

1. Detect polyfill.io usage in documentation: Scan generated HTML files for references to polyfill.io.
2. Monitor network traffic: Look for outbound connections to polyfill.io or related domains.
3. Regenerate documentation: After upgrading pdoc, regenerate all documentation to remove the malicious link.

Detection script:

grep -r "polyfill.io" /path/to/documentation/

Indicators of Compromise (IOCs)

• Domains:

  • polyfill.io
  • bootcdn.net
  • bootcss.com
  • staticfile.net
  • staticfile.org
  • unionadjs.com
  • xhsbpza.com
  • union.macoms.la
  • newcrbpc.com

• File Hashes: (None specific to this CVE, but any JavaScript served from the above domains should be treated as suspicious)

• Network Patterns:

  • Outbound HTTP/HTTPS requests to polyfill.io or its subdomains
  • Unexpected JavaScript execution from third-party CDNs

Detection Engineering

YARA Rule

rule CVE_2024_38526_Polyfill_Supply_Chain {
    meta:
        description = "Detects pdoc generated documentation referencing polyfill.io"
        author = "Valters IT"
        date = "2024-01-01"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2024-38526"
    strings:
        $polyfill = "polyfill.io" nocase
        $pdoc_marker = "pdoc" nocase
    condition:
        $polyfill and $pdoc_marker
}

Sigma Rule

title: Polyfill.io Supply Chain Attack in pdoc Documentation
id: 5c8e8f8a-1234-5678-9abc-def012345678
status: experimental
description: Detects pdoc generated HTML files that include polyfill.io scripts
author: Valters IT
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '.html'
        TargetFilename|contains: 'pdoc'
    keywords:
        - 'polyfill.io'
    condition: selection and keywords
falsepositives:
    - Legitimate use of polyfill.io (pre-sale)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2024-38526 Polyfill Supply Chain Attack"; flow:to_server; content:"polyfill.io"; http_host; classtype:attempted-user; sid:1000001; rev:1;)

Nuclei Template

id: CVE-2024-38526

info:
  name: Polyfill Supply Chain Attack Malicious Code Execution
  author: abut0n
  severity: high
  description: |
    pdoc provides API Documentation for Python Projects. Documentation generated with `pdoc --math` linked to JavaScript files from polyfill.io
  impact: |
    The polyfill.io CDN has been sold and now serves malicious code.
  remediation: |
    This issue has been fixed in pdoc 14.5.1.
  reference:
    - https://sansec.io/research/polyfill-supply-chain-attack
    - https://nvd.nist.gov/vuln/detail/CVE-2024-38526
    - https://x.com/triblondon/status/1761852117579427975
    - https://github.com/mitmproxy/pdoc/pull/703
    - https://github.com/mitmproxy/pdoc/security/advisories/GHSA-5vgj-ggm4-fg62
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:N/A:L
    cvss-score: 7.2
    cve-id: CVE-2024-38526
    epss-score: 0.82528
    epss-percentile: 0.99238
  tags: cve,cve2024,supply-chain,polyfill,vkev,vuln
headless:
  - steps:
      - args:
          url: "{{BaseURL}}"
        action: navigate

      - action: waitload

      - action: script
        name: extract
        args:
          code: |
            () => {
             return '\n' + [...new Set(Array.from(document.querySelectorAll('[src], [href], [url], [action]')).map(i => i.src || i.href || i.url || i.action))].join('\r\n') + '\n'
            }

    extractors:
      - type: kval
        part: extract
        name: urls
        internal: true
        kval:
          - extract

    matchers:
      - type: word
        words:
          - "polyfill.io"
          - "bootcdn.net"
          - "bootcss.com"
          - "staticfile.net"
          - "staticfile.org"
          - "unionadjs.com"
          - "xhsbpza.com"
          - "union.macoms.la"
          - "newcrbpc.com"
        part: urls
# digest: 490a00463044022043326572a6fa72b186b3efaaae4e88075f42344334cd2f6f9da3481542eaa3950220516860e0699cb4b3f61e55dd6633b6e638880e713894e27746f466f2820ee0d7:922c64590222798bb761d5b6d8e72950

Remediation & Mitigation

1. Upgrade pdoc: Update to version 14.5.1 or later.

   pip install --upgrade pdoc
   

2. Regenerate documentation: After upgrading, regenerate all documentation that was created with the --math flag.

   pdoc --math my_module -o docs/
   

3. Remove old documentation: Delete or replace any previously generated documentation that may still contain the polyfill.io link.

4. Monitor for polyfill.io usage: Use the provided YARA/Sigma rules to scan existing documentation for the malicious link.

5. Network blocking: Block outbound connections to polyfill.io and related domains at the firewall or proxy level.

6. User awareness: Inform users who may have visited compromised documentation to check for signs of compromise (e.g., unexpected redirects, performance issues).

Report generated by Valters IT DevSecOps & CTI Framework

{/* [Security Hash: 003ACCC23E1210B09C7C0AEC] */}