• Sublime Core Feed
High Severity

Attachment: HTML smuggling with atob and high entropy

Labels

Description

Recursively scans files and archives to detect HTML smuggling techniques using Javascript atob functions.

References

Sublime Security
Created Aug 17th, 2023 • Last updated Jan 14th, 2024
Feed Source
Sublime Core Feed
Source
GitHub
type.inbound
and any(attachments,
        (
          .file_extension in~ ("html", "htm", "shtml", "dhtml", "eml")
          or .file_extension in~ $file_extensions_common_archives
          or .file_type == "html"
          or .content_type == "message/rfc822"
        )
        and any(file.explode(.),
                .scan.entropy.entropy >= 5
                and (
                  length(filter(.scan.javascript.identifiers,
                                strings.like(., "document", "write", "atob")
                         )
                  ) == 3
                  // usage: document['write'](atob)
                  or any(.scan.strings.strings, regex.icontains(., "document.{0,10}write.{0,10}atob"))
                  // usage: some_var = atob();
                  or any(.scan.strings.strings, regex.icontains(., "=.?atob.*;"))
                  // usage: atob(atob
                  or any(.scan.strings.strings, strings.ilike(., "*atob?atob*"))
                  // usage: eval(atob)
                  or any(.scan.strings.strings, strings.ilike(., "*eval?atob*"))
                    // usage: atob(_0x)
                  or any(.scan.strings.strings, strings.ilike(., "*atob(?0x*"))
                  // usage: obfuscating "atob"
                  or any(.scan.javascript.identifiers, strings.ilike(., '*ato\u0062*'))
                  // usage: document.head.insertAdjacentHTML("beforeend", atob(...
                  or any(.scan.strings.strings,
                         strings.ilike(.,
                                       "*document*insertAdjacentHTML*atob*"
                         )
                  )
                )
        )
)
// negate highly trusted sender domains unless they fail DMARC authentication
and (
  (
    sender.email.domain.root_domain in $high_trust_sender_root_domains
    and (
      any(distinct(headers.hops, .authentication_results.dmarc is not null),
          strings.ilike(.authentication_results.dmarc, "*fail")
      )
    )
  )
  or sender.email.domain.root_domain not in $high_trust_sender_root_domains
)

Playground

Test against your own EMLs or sample data.

Share

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.

Get Started