Is Track24.ru safe?
Track24.ru fetches and executes remote JavaScript from api.track24.ru on AliExpress order pages without any integrity check.
When a user visits AliExpress order list pages, the extension's content script retrieves a JavaScript file from api.track24.ru and evaluates it directly using eval(). The evaluated code runs in content-script scope with access to the Chrome extension runtime. The extension also ships a hardcoded API key in its bundle, which is transmitted to api.track24.ru with every package tracking request.
AI-generated. Findings may contain errors. Those marked Verified have been manually reviewed.
Publishers can request a review.
Findings
Track24.ru evaluates remote code on AliExpress order pages
Track24.ru runs on every HTTP/HTTPS page, then on matching AliExpress order-list pages fetches JS from api.track24.ru/extension/appKey.php and passes it to eval().
Dynamic analysis missed this call, as AliExpress redirected to login first.
You open an AliExpress order-list page.
The branch requires an AliExpress order-list URL and order-row elements in the page.
The extension asks api.track24.ru for JavaScript and runs the response.
The code assigns appKey and cp from the evaluated response, then continues processing order rows.
| Field | Value | Why it matters | |
|---|---|---|---|
AliExpress order URL | https://trade.aliexpress.com/orderList.htm | This limits the remote-code branch to order-list pages you visit. | |
Order-row selector | .order-body or .OrderList_OrderItem__productItemWrap__ | The extension waits for order-list content before requesting the remote script. | |
Remote script endpoint | https://api.track24.ru/extension/appKey.php | This host supplies the JavaScript text that the extension runs on the order page. | |
Values assigned by the response | appKey and cp | The response is expected to define values the extension reuses for later tracking requests. |
The shipped branch that fetches and evaluates appKey.php
"content_scripts": [
{
"matches": ["http://*/*", "https://*/*"],
"css": ["css/style.css", "css/font-awesome.min.css", "css/simpleTooltips.css", "css/animate.min.css", "css/price.css"],
"js": ["js/jquery-latest.js", "js/content.js", "js/aes.js", "js/simpleTooltips.js", "js/jquery.storage.js", "js/chart.min.js", "js/price.js"]
}
]if ((document.location.href.indexOf("trade.aliexpress.com/order_list.htm") > 0) || (document.location.href.indexOf("trade.aliexpress.com/orderList") > 0) || (document.location.href.indexOf("trade.aliexpress.ru/orderList.htm") > 0) ){
var regExpPattern = /OrderList_OrderItem__productItemWrap__(\w{4,10})/;
var match = regExpPattern.exec($("body").html());
orderV2RowClass = (match !== null) ? ".OrderList_OrderItem__productItemWrap__"+match[1] : null;
if ((($('.order-body').length) > 0) || (($(orderV2RowClass).length) > 0)) {
$.get("https://api.track24.ru/extension/appKey.php", function(data) {
eval(data);
n_appKey = appKey;
n_cp = cp;
renderLastEventsWrapperElements();
$(".OrderList_ButtonLoadMore__loadMoreBtn__1vphe").click(function(e) {
e.preventDefault();
setTimeout(function() {
renderLastEventsWrapperElements();
}, 1500);
});
});
}
}- api.track24.ru
Receives the appKey.php request and returns JavaScript that the content script evaluates.
- aliexpress.ru
Receives order-tracking history requests from the background script after an order ID is extracted from the page.