[Security Alert] The Open Street Maps (OSM) Add-On appears to have polyfill.io exploit vulnerability

[justinhow]

The OSM add-on adds this "https://cdn.polyfill.io/v2/polyfill.min.js" to a number of TNG php files and it also appears in heatmap_OSM.php. This includes the latest version Openstreetmap_v14.0.5.9.zip.

This would appear to make it vulnerable to the Polyfill exploit (https://dev.to/snyk/polyfill-supply-chain-attack-embeds-malware-in-javascript-cdn-assets-55d6)

Cloudflare have a blog post about how to remove the vulnerability here https://blog.cloudflare.com/polyfill-io-now-available-on-cdnjs-reduce-your-supply-chain-risk 

I edited my own copies of the OSM .cfg and heatmap_OSM.php files to make the required change as described in the blog.

I would suggest the folks who look after this add-on have a look at this issue (I realise the original developer no longer manages it) ASAP.

[tngrlkrz]

9 hours ago, justinhow said:

I would suggest the folks who look after this add-on

Have sent you a PM.

Ron

[Ken Roy]

On 6/29/2024 at 10:14 AM, justinhow said:

The OSM add-on adds this "https://cdn.polyfill.io/v2/polyfill.min.js" to a number of TNG php files and it also appears in heatmap_OSM.php. This includes the latest version Openstreetmap_v14.0.5.9.zip.

I reworked the OpenStreetMap mod for TNG 14.0.5 only because Michel was not available.

Ron sent me a reworked version of the mod but I have not posted it because I do not have the time to test and am wondering whether the whole polyfill javascript could not simply be removed.

I do not have the time to test any of this and only use the OpenStreetMap to ensure that both the Google Maps and OpenStreetMap work for the Ancestor Map 

Dealing with more important life issues

[Steve1200]

I commented out those polyfill javscript lines yesterday and I have not found any issues so far.

[Ken Roy]

I have posted OpenStreetMap  v14.0.5.9b that removes all the links to polyfill.io.

Our thanks to Ron Krzmarzick for providing the fix identified in cloudfare (v14.0.5.9a) and for testing v14.0.5.9b that removed all links to polyfill.io

[Katryne]

Ken, it says cannot install. My TNG is 14.0.4.

[Ken Roy]

Katryne,

Sorry I only reworked the mod for TNG 14.0.5 since I am trying to get my own site upgraded to TNG 14.0.5

Edited to add -- The first 3 digits of the mod number are v14.0.5 which means that is the earliest version of TNG that the mod will install and work on.  

[Katryne]

Don't worry, I put back the "old" v.13.1.0.8j
But I do not understand a word of the 2 links that Justinhow posted.

[Katryne]

I re-installed my version 13.1.0.8j after modifying 2 files :

in the cfg file, I deleted 5 lines that mentionned polyfill (=10 occurences)

in the folder, in heatmap.com.php, I deleted 1 line that mentionned polyfill (=2 occurences)

It seems to be working well. Is this the right thing to do?

[Ken Roy]

Katryne,

That sounds right.  Since it does not look like I will get my production site which is also at TNG 14.0.4 upgraded any time soon, I created v13.1.0.9 of the mod  today, installed it on my production site, and have now posted on the TNG Wiki for those running TNG 13.1 through TNG 14.0.4