Executive brief
Version 0.1.2 of vue-backbone, a JavaScript library for web applications, contained malicious code that would steal sensitive payment and authentication data from web forms. When a user's browser loaded the compromised package, the code would harvest password, credit card, and CVC fields and exfiltrate them to an attacker-controlled server, potentially compromising customer data and enabling fraud.
Technical details
The vulnerability is a malicious code injection in vue-backbone v0.1.2, classified as CWE-506 (Embedded Malicious Code). The attack vector is network-based with no authentication or user interaction required—the malicious payload executes automatically when the compromised package is loaded in a browser context. The injected code specifically targets HTML form fields containing passwords, credit card numbers, and CVC codes, exfiltrates these values via HTTP GET requests to https://js-metrics.com/minjs.php, and provides attackers direct access to sensitive payment and authentication credentials. The vulnerability was patched in version 0.1.3. Any application that included vue-backbone v0.1.2 as a dependency should be immediately audited for form data exposure.
Affected products
- npm vue-backbone 0.1.2
Timeline
- 2020-09-03: disclosed
- 2020-09-03: patched: Fixed in version 0.1.3