You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@spamassassin.apache.org by fk...@apache.org on 2026/05/21 17:29:06 UTC
svn commit: r1934484 - spamassassin/trunk/rulesrc/sandbox/fkento
Author: fkento
Date: Thu May 21 17:29:06 2026
New Revision: 1934484
Log:
Add rule to detect Microsoft OAuth authorize endpoint redirector abuse
Modified:
spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf
Modified: spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf
==============================================================================
--- spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf Thu May 21 17:28:05 2026 (r1934483)
+++ spamassassin/trunk/rulesrc/sandbox/fkento/20_misc.cf Thu May 21 17:29:06 2026 (r1934484)
@@ -43,3 +43,9 @@ describe FKO_GOOGLE_LUCKY Google "
uri FKO_DDG_DUCKY /^https?:\/\/(?:www\.)?duckduckgo\.com\/?\?(?:.*&)?q=!ducky/i
describe FKO_DDG_DUCKY DuckDuckGo "I'm feeling ducky" search
+
+uri __FKO_MS_OAUTH_SILENT /^https?:\/\/login\.microsoftonline\.com\/[^\/?\#]+\/oauth2\/(?:v2\.0\/)?authorize\?(?:[^"\s]*&)?prompt=none(?:&|$)/i
+uri __FKO_MS_OAUTH_FAKE_URI /^https?:\/\/login\.microsoftonline\.com\/[^\/?\#]+\/oauth2\/(?:v2\.0\/)?authorize\?(?:[^"\s]*&)?uri=https?(?::|%3A)/i
+meta FKO_MS_OAUTH_REDIR_ABUSE __FKO_MS_OAUTH_SILENT && __FKO_MS_OAUTH_FAKE_URI
+score FKO_MS_OAUTH_REDIR_ABUSE 0.1
+describe FKO_MS_OAUTH_REDIR_ABUSE Microsoft OAuth authorize endpoint abused as a phishing redirector