API10:2023 — Unsafe Consumption of APIs

Slide 10 · Pattern 1 Mechanics

CDN compromise → Malicious script on trusted pages → Data exfiltration at browser level

Step by step: how a third-party CDN compromise becomes a payment card skimmer on hundreds of checkout pages.

THE SETUP

An e-commerce checkout page that loads a third-party analytics or chatbot script.

The checkout page HTML includes: <script src="https://vendor-cdn.example.com/widget.js"></script>

This script is loaded from the vendor’s CDN with no integrity verification (integrity= attribute absent). It runs in the context of the payment page with full DOM access — it can read any field the user types, including card numbers, CVV codes, and billing addresses.

1️⃣

Attacker compromises the vendor’s CDN

Through a credential theft, a CDN misconfiguration, or a vulnerability in the vendor’s deployment pipeline, the attacker gains write access to the CDN file. They modify widget.js to append a skimming payload: a few lines that listen for form submissions, capture card data, and POST it to an attacker-controlled domain.

2️⃣

Every page load now delivers the malicious script

The checkout page loads widget.js fresh on each visit — from the CDN. Every user who loads the checkout page now executes the skimming payload. The consuming site’s own security controls — its WAF, its CSP (if absent), its API security — are irrelevant. The attack runs in the browser before any data reaches the server.

3️⃣

Attacker harvests card data in real time

As users complete checkout, the skimmer intercepts the form submission, copies card number, expiry, CVV, and billing address, and sends them to https://cdn-static[.]su/track (or similar attacker-controlled domain disguised as a CDN). The legitimate form submission also goes through normally — the user sees no error. The theft is invisible to the victim, the merchant, and their payment processor.

← Back Real incident: Ticketmaster →