topic Howto filter javascript in mail-data? in General Topics

Howto filter javascript in mail-data?

mhuels — Mon, 30 May 2011 14:04:57 GMT

It seems to be not possible to write a custom signature, which filters out javascript in mails.

The challenge is to avoid something like that:

#> telnet server 25

helo willi

mail from:<otto@lbsost.de>
rcpt to:<m.huels@lbswast.de>
data
From: Mannis Emailcheck <otto@lbsost.de>
To: willi@lbswist.de
X-Mailer: Mein Mailer
Subject: test fuer javascript
MIME-Version: 1.0
Content-Type: text/html; charset=iso-8859-1
Content-Transfer-Encoding: 7bit
X-Real-Name: otto.lbsost.de

<html>
<body>
<A HREF="javascript:void(0)"
onclick="window.open('http://www.dackel.de','OK-Link')">
OK</A>
<script>alert("Virus - please click here to exploit your computer")</script>

</body>
</html>

quit

I tried

.*(220 mail).*(.de ESMTP).*(\x3c\x).*([sS][cC][rR][iI][pP][tT])

as a data pattern. But if i put this data pattern in a data filtering rule, it only filters in attachements and not in the mail text itself.

Defined as spyware or vulnerability signature, you can only set

pattern-match -> smtp-req-argument

pattern-match -> smtp-resp-content

pattern-match -> unknown-req-tcp-payload

I will try and error this parameter in the next days (because its a lengthy process to install new rules on the firewall 😉 and do report the results in this thread.

so long

Manfred

Re: Howto filter javascript in mail-data?

mhuels — Mon, 30 May 2011 14:59:59 GMT

pattern-match -> smtp-resp-content does not works.

Re: Howto filter javascript in mail-data?

fredallee — Tue, 31 May 2011 06:22:03 GMT

I've tried email header and email body pattern matches from the custom data patterns and it's worked in the past. Can you try creating a custom data pattern?

Re: Howto filter javascript in mail-data?

mhuels — Tue, 31 May 2011 08:07:43 GMT

I tried to set the custom data pattern in a data filtering rule, which did not work.

Perhaps PA covers the SMTP header and the data-body in two different matching-machines? If so, i would have to set two patterns. But although ".*(\x3c\x[sS][cC][rR][iI][pP][tT])" has 7 byte, you cannot install it because of beeing too short. ".*(<script)" and ".*(\x3c\xscript)" are both malformed, "script" has only 6 byte and again would it be not sufficient for this case.