CVE-2024-38537: Inclusion of Untrusted polyfill.io Code Vulnerability in fides.js

fides.js, a client-side script used to interact with the consent management features of Fides, used the polyfill.io domain in a very limited edge case, when it detected a legacy browser such as IE11 that did not support the fetch standard.

On June 25th, 2024, Sansec published the following regarding the polyfill.io domain.

The polyfill.js is a popular open source library to support older browsers. 100K+ sites embed it using the cdn.polyfill.io domain… However, in February this year, a Chinese company bought the domain and the Github account. Since then, this domain was caught injecting malware on mobile devices via any site that embeds cdn.polyfill.io.

Therefore it was possible for users of legacy, pre-2017 browsers who navigate to a page serving fides.js to download and execute malicious scripts from the compromised domain.

No exploitation of fides.js via polyfill.io has been identified at this time, but other script developers who use https://cdn.polyfill.io/v2/polyfill.min.js have reported redirects to malicious websites.