Hello..

This morning, reviewing our IIS logs and saw this jQuery attack on one of our Portal websites.  The IIS logs are reporting a 404 status for everything.  The csUserAgent is shown as Java/1.6.0_04.

/Resources/Shared/Scripts/jquery/jquery-ui.min.js
/Resources/Shared/Scripts/jquery/jquery.hoverIntent.min.js
/Resources/Shared/Scripts/jquery/jquery.min.js
/Resources/Shared/Scripts/jquery/).addClass(this._triggerClass).html(f==
/Resources/Shared/Scripts/jquery/);if(c.label===null)c.label=this.buttonElement.html();if(this.element.is(
/Resources/Shared/Scripts/jquery/).html(this.buttonElement.find(
/Resources/Shared/Scripts/jquery/).html());this.hasTitle||this.buttonElement.removeAttr(
/Resources/Shared/Scripts/jquery/,d.uiDialogTitlebar).html(
/Resources/Shared/Scripts/jquery/,j.html()).html(a.spinner)}this.xhr=d.ajax(d.extend({},a.ajaxOptions,{url:h,success:function(k,n){e.element.find(e._sanitizeSelector(c.hash)).html(k);e._cleanup();a.cache&&d.data(c,

IP was from Romania.

Jeff,

I got the same kind of attack on one of my sites. It triggered Page Load Exceptions in the DNN Event Log saying, "A potentially dangerous Request.Path value was detected". Here are two of the entries:

RawURL: /Resources/Shared/Scripts/jquery/,data:c,complete:function(a,b,c){c=a.responseText,a.isResolved()&&(a.done(function(a){c=a}),i.html(g?f(

AbsoluteURL: /Resources/Shared/Scripts/jquery/,data:c,complete:function(a,b,c)%7Bc=a.responseText,a.isResolved()&&(a.done(function(a)%7Bc=a%7D),i.html(g

AbsoluteURLReferrer:

UserAgent: Java/1.6.0_04

DefaultDataProvider: DotNetNuke.Data.SqlDataProvider, DotNetNuke.SqlDataProvider

ExceptionGUID: 9f42e231-7b2b-4599-ab5f-41b937501fb8

InnerException: A potentially dangerous Request.Path value was detected from the client (:).

FileName:

FileLineNumber: 0

FileColumnNumber: 0

Method: System.Web.HttpRequest.ValidateInputIfRequiredByConfig

StackTrace:

Message: DotNetNuke.Services.Exceptions.PageLoadException: A potentially dangerous Request.Path value was detected from the client (:). ---> System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (:). at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.ValidateRequestExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) --- End of inner exception stack trace ---

 and...

RawURL: /Resources/Shared/Scripts/jquery/,j.html()).html(a.spinner)}this.xhr=d.ajax(d.extend({},a.ajaxOptions,{url:h,success:function(k,n){e.element.find(e._sanitizeSelector(c.hash)).html(k);e._cleanup();a.cache&&d.data(c,

AbsoluteURL: /Resources/Shared/Scripts/jquery/,j.html()).html(a.spinner)%7Dthis.xhr=d.ajax(d.extend(%7B%7D,a.ajaxOptions,%7Burl:h,success:function(k,n)%7Be.element.find(e._sanitizeSelector(c.hash)).html(k);e._cleanup();a.cache&&d.data(c,

AbsoluteURLReferrer:

UserAgent: Java/1.6.0_04

DefaultDataProvider: DotNetNuke.Data.SqlDataProvider, DotNetNuke.SqlDataProvider

ExceptionGUID: 0ee66043-3fd9-4409-822b-ea9fc926b2af

InnerException: A potentially dangerous Request.Path value was detected from the client (:).

FileName:

FileLineNumber: 0

FileColumnNumber: 0

Method: System.Web.HttpRequest.ValidateInputIfRequiredByConfig

StackTrace:

Message: DotNetNuke.Services.Exceptions.PageLoadException: A potentially dangerous Request.Path value was detected from the client (:). ---> System.Web.HttpException: A potentially dangerous Request.Path value was detected from the client (:). at System.Web.HttpRequest.ValidateInputIfRequiredByConfig() at System.Web.HttpApplication.ValidateRequestExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() at System.Web.HttpApplication.ExecuteStep(IExecutionStep step, Boolean& completedSynchronously) --- End of inner exception stack trace ---

Jos,

You could ask your webhosting provider to check their FTP logs (unless you have access to them) and see if the attack came via FTP (see if someone logged in during the timeframe of the attack). If so, then changing your FTP password to something stronger should help avoid a future attack.

If it wasn't an FTP attack, then it may have come through some sort of DNN access, and we would all like to know the details of that. One starting point would be to check the DNN Event Log for access during that time, along with the IIS web server logs.

Please let us know what you find out. Thanks.