External JavaScript alerts

[pgnair]

We migrated one of our project from 14 to 15 two months back, done a quarterly audit last week and  there is one vulnerability -  Suspicious Change -    Found External JavaScript alerts


Detail:
We detected suspicious change in the code.The URL header may be changed by an external entity. If this change is authentic then you can neutralize it.

the only change what we done is IW14 it was running as Standlaone exe, in IW15 it is running as a standalone service.

Here I am attaching the details. What could be the issue please? Please advise

[Alexandre Machado]

Hi Pramod,

I'll have a look and let you know ASAP. But at first it looks like a false positive...

Cheers

[pgnair]

Hi Pramod,

I'll have a look and let you know ASAP. But at first it looks like a false positive...

Cheers

Sorry Alex as client asking for immediate fix , did you get a chance to look on it please?

[kudzu]

What program is producing this alert?

[pgnair]

What program is producing this alert?

Sorry didnt get what you meant

[kudzu]

Where is this report generated from?

[Alexandre Machado]

I've already responded via e-mail, yesterday.

The point is that seems that the auditors don't like self-modifying code, but this is a legit case. From their report:

"The URL header may be changed by an external entity. If this change is authentic then you can neutralize it."

yes, it is authentic. There is nothing wrong going on and they would know by code inspection.

[pgnair]

I've already responded via e-mail, yesterday.

The point is that seems that the auditors don't like self-modifying code, but this is a legit case. From their report:

"The URL header may be changed by an external entity. If this change is authentic then you can neutralize it."

yes, it is authentic. There is nothing wrong going on and they would know by code inspection.

Thanks a lot for the update Alex.

PS: I didn't get your email.