HTTP: HTML "data:" URL Scheme
This signature detects the download of a HTML document containing parameters using the "data:" URL scheme. This scheme is defined in RFC2397 and is a legitimate usage of HTML. However, attackers can use the scheme to first embed malware in a Web page, then bypass specific filters that normally detect such a delivery.
Extended Description
Attackers could exploit the "data" URL scheme specified in RFC 2397 to include malicious content in an HTML document. The impact depends on what kind of malware is included.
References
Short Name
HTTP:STC:DATA-SCHEME
Severity
Warning
Recommended
False
Recommended Action
None
Category
HTTP
Keywords
"data:" HTML Scheme URL
Release Date
01/14/2005
Supported Platforms
srx-branch-12.3
srx-19.3
srx-branch-19.3
vsrx3bsd-19.2
srx-branch-19.4
vsrx-19.4
mx-12.3
mx-19.4
vmx-19.4
mx-19.3
vsrx3bsd-19.4
srx-19.4
vsrx-12.3
vmx-19.3
vsrx-19.2
srx-12.3
Sigpack Version
3375
False Positive
Frequently