Executive brief
scroool is a JavaScript library used in web applications. Version 0.1.7 contained malicious code that, when executed in a user's browser, harvests sensitive form fields (passwords, credit card numbers, and security codes) and sends them to an attacker-controlled server, potentially exposing customer financial and authentication data.
Technical details
scroool version 0.1.7 contains embedded malicious code that runs client-side in the browser. The vulnerability is a supply-chain attack (compromised package) that performs form-field harvesting: when the library loads, it scans the page for password, CVC, and cardnumber form fields, extracts their values, and exfiltrates them to https://js-metrics.com/minjs.php via HTTP GET request. No authentication or user interaction is required beyond the normal use of a web application that includes the affected library. Any sensitive data entered into targeted form fields is transmitted to the attacker. The fix is to remove version 0.1.7 and downgrade to version 0.1.6 or later uncompromised versions.
Affected products
- scroool scroool 0.1.7
Timeline
- 2020-09-11: disclosed