svn commit: r1936520 - in spamassassin/trunk: lib/Mail/SpamAssassin/Plugin rules rulesrc/sandbox/gbechis

Author: gbechis
Date: Thu Jul 23 11:04:23 2026
New Revision: 1936520

Log:
detect Microsoft Oauth2 service abuse

Added:
   spamassassin/trunk/rulesrc/sandbox/gbechis/20_ms.cf
Modified:
   spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Redirectors.pm
   spamassassin/trunk/rules/25_url_redirectors.cf

Modified: spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Redirectors.pm
==============================================================================
--- spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Redirectors.pm	Thu Jul 23 10:46:30 2026	(r1936519)
+++ spamassassin/trunk/lib/Mail/SpamAssassin/Plugin/Redirectors.pm	Thu Jul 23 11:04:23 2026	(r1936520)
@@ -1172,6 +1172,17 @@ sub _do_http {
 	return;
       } else {
         $newurl = $ua->get_current_url();
+        # get_current_url() right after ->get() only reflects the page that
+        # just finished loading, it does not wait for any client-side
+        # (JS/timer-driven) navigation that page goes on to trigger a few
+        # seconds later, poll for a bit before concluding this wasn't a redirect.
+        my $wait_secs = $conf->{url_redirector_timeout} || 5;
+        for (1 .. $wait_secs) {
+          last if $newurl ne $redir_url;
+          sleep 1;
+          my $polled = eval { $ua->get_current_url() };
+          $newurl = $polled if defined $polled;
+        }
         if($newurl ne $redir_url) {
           $rcode = 301;
         } else {

Modified: spamassassin/trunk/rules/25_url_redirectors.cf
==============================================================================
--- spamassassin/trunk/rules/25_url_redirectors.cf	Thu Jul 23 10:46:30 2026	(r1936519)
+++ spamassassin/trunk/rules/25_url_redirectors.cf	Thu Jul 23 11:04:23 2026	(r1936520)
@@ -271,6 +271,7 @@ endif
 #
 if can(Mail::SpamAssassin::Plugin::Redirectors::has_url_redirector_selenium)
     url_redirector_selenium .blob.core.windows.net
+    url_redirector_selenium login.microsoftonline.com/common/oauth2/v2.0/authorize
     url_redirector_selenium uselesstools.jonfinger.com/r
 endif
 

Added: spamassassin/trunk/rulesrc/sandbox/gbechis/20_ms.cf
==============================================================================
--- /dev/null	00:00:00 1970	(empty, because file is newly added)
+++ spamassassin/trunk/rulesrc/sandbox/gbechis/20_ms.cf	Thu Jul 23 11:04:23 2026	(r1936520)
@@ -0,0 +1,10 @@
+# real Microsoft authorize links only honor the
+# pre-registered "redirect_uri"; a "redirect_url" (or similar look-alike)
+# query parameter carrying an external URL is not a real OAuth2 parameter
+# and is a strong sign the link was built by a phishing kit riding on
+# Microsoft's domain reputation.
+uri      __GB_MSFT_OAUTH_AUTHORIZE   /^https?:\/\/login\.microsoftonline\.com\/[^\/?\#]+\/oauth2\/v2\.0\/authorize\?/i
+uri      __GB_MSFT_OAUTH_FAKE_REDIR  /[?&]redirect_url=https?(?::|%3a)/i
+meta     GB_MSFT_OAUTH_CONSENT_PHISH (__GB_MSFT_OAUTH_AUTHORIZE && __GB_MSFT_OAUTH_FAKE_REDIR)
+describe GB_MSFT_OAUTH_CONSENT_PHISH Message links to a Microsoft OAuth authorize URL carrying a spoofed non-standard redirect parameter
+score    GB_MSFT_OAUTH_CONSENT_PHISH 1.5 # limit