Medium Severity

Open redirect: Staples SSO authentication

Labels

Description

Detects inbound messages containing links that abuse the Staples.ca SSO authentication endpoint (/sso/auth) with a Redirect_URI parameter pointing to a domain other than staples.ca. This open redirect pattern is often leveraged to lend legitimacy to malicious destination URLs. The rule excludes messages where the sender's domain is staples.ca or a highly trusted root domain and the message passes DMARC authentication.

References

No references.

Sublime Security

Created Oct 7th, 2026 • Last updated Oct 7th, 2026

Feed Source

Sublime Core Feed

Source

GitHub

type.inbound
and any(body.links,
        .href_url.domain.root_domain == "staples.ca"
        and strings.icontains(.href_url.path, '/sso/auth')
        and strings.icontains(.href_url.query_params, 'Redirect_URI=')
        // make sure it's not redirecting back to staples.ca
        and not regex.icontains(.href_url.query_params,
                                'redirect_uri=(?:https?(?:%3a|:))?(?:%2f|\/)*[^&]*staples\.ca(?:&|\/|$|%2f)'
        )
)
and not (
  sender.email.domain.root_domain == "staples.ca"
  and coalesce(headers.auth_summary.dmarc.pass, false)
)
// negate highly trusted sender domains unless they fail DMARC authentication
and not (
  sender.email.domain.root_domain in $high_trust_sender_root_domains
  and coalesce(headers.auth_summary.dmarc.pass, false)
)

MQL Rule Console

•Docs•Learning Labs

Playground

Test against your own EMLs or sample data.

Post about this on your socials.

Get Started. Today.

Managed or self-managed. No MX changes.