Is it possible to be attacked with XSS on a static page (i.e. without PHP)?

Question

A client I'm working for has mysteriously ended up with some malicious scripting going on on their site. I'm a little baffled however because the site is static and not dynamically generated - no PHP, Rails, etc. At the bottom of the page though, somebody opened a new tag and a script. When I opened the file on the webserver and stripped the malicious stuff and re-uploaded, it was still there. How is this possible? And more importantly, how can I combat this?

EDIT: To make it weirder, I just noticed the script only shows up in the source if the page is accessed directly as 'domain.com/index.html' but not as just 'domain.com'.

EDIT2: At any rate, I found some php file (x76x09.php) sitting on the web server that must have been updating the html file despite my attempts to strip it of the script. I'm currently in the clear but I do have to do some work to make sure rogue files don't just appear again and cause problems. If anyone has any suggestions on this feel free to leave a comment, otherwise thanks for the help everyone! It was very much appreciated!

Answer 1

No it's not possible unless someone has access to your files. So in your case someone has access to your files.

Edit: It's best if you ask in serverfault.com regarding what to do in case the server is compromised, but:

• change your shell passwords
• have a look at /var/log/messages for login attempts
• finger root
• have a look at last modification time of those files

There is also a high propability that the files where altered via http by using a vulnerability of a software component you use together with the static files.

Answer 2

You should probably talk to your hosting company about this. Also, check that your file permissions aren't more lenient than they should be for your particular environment.

Answer 3

That's happened to me before - this happens if they get your ftp details. So, whoever did it, obviously got ahold of your ftp details somehow.

Best thing to do is change your password and contact your webhosting company to figure out a better solution.

Unfortunately, FTP isn't the most secure...

Answer 4

To the point about the site not having pages executing on the server, XSS is absolutely still possible using a DOM based attack. Usually this will relate to JavaScript execution outputting content to the page. Just last week WhiteHat Security had an XSS vulnerability identified on a purely “static” page.

It may well be that the attack vector relates to file level access but I suggest it’s also worthwhile taking a look at what’s going on JS wise.