""ET WEB_CLIENT Apple Safari UXSS (CVE-2017-7089)""

SID: 2024995

Revision: 2

Class Type: attempted-user

Metadata: affected_product Safari, attack_target Client_Endpoint, created_at 2017_11_15, cve CVE_2017_7089, deployment Perimeter, performance_impact Low, signature_severity Major, tag Web_Client_Attacks, updated_at 2017_11_15

Reference:

• cve

• 2017-7089

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: from_server,established

Contents:

• Value: "parent-tab://"

• Value: "open"

Within:

PCRE: "/\b(?P[^\s\x3d]+)\s\x3d\sopen\s\x28\s[^\x29]+parent-tab:\/\/.+(?P=varname)\s.\sdocument\s.\sbody\s.\sinnerHTML\s*=/si"

Special Options:

• file_data

source