Signature Detail
Short Name |
HTTP:STC:DATA-SCHEME |
|---|---|
Severity |
Low |
Recommended |
No |
Category |
HTTP |
Keywords |
malware http data scheme |
Release Date |
2005/01/13 |
Update Number |
1213 |
Supported Platforms |
idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
HTTP: HTML "data:" URL Scheme
This signature detects the download of a HTML document containing parameters using the "data:" URL scheme. This scheme is defined in RFC2397 and is a legitimate usage of HTML. However, attackers can use the scheme to first embed malware in a Web page, then bypass specific filters that normally detect such a delivery.
Extended Description
Attackers could exploit the "data" URL scheme specified in RFC 2397 to include malicious content in an HTML document. The impact depends on what kind of malware is included.
References