Security scan - compromise injection

[phantonym]

Is this a real threat or is it a false positive?

More scripts load from the same domain, but only this one is reported.

[Tarandeep Singh]

@phantonymFor some reason your screenshot is not visible. Can you please upload it again or share a URL of the screenshot using any online tool.

[Mukesh Tiwari]

Hi @phantonym 

Are you using https://marketplace.magento.com/searchanise-simtech-searchanise.html extension?

It may be the part of the extension. If not then you should check at following location

Configuration>General>Design>HTML Head. If it is present there you can remove it.

[phantonym]

@Tarandeep SinghLink to screenshot: https://i.imgur.com/kZz2eQe.png

@Mukesh TiwariYes, Simtech Searchanise is used.

[Tarandeep Singh]

@phantonymExtension is including the JS which contains encrypted code in base64 format. You can see the JS URL in your screenshot and when you'll open it in browser you can see the same code in the file.

Magento security scan is flagging that code as security vulnerability. To make sure that you does not get compromise my recommendation would be:

1. Connect with extension provider to make sure that they are aware of that code and it is not compromised.

2. Drop an email to Magento security team "securityinfo@magento.com" and provide the details of your scan to get more help.

Problem solved? Please give 'Kudos' and accept 'Answer as Solution'.