alert http $EXTERNAL_NET any -> $HOME_NET any (
msg:"ET WEB_CLIENT Adobe Flash Player Rosetta Flash compressed CWS";
flow:established,from_server;
content:"callback=CWS"; nocase; fast_pattern;
content:"<object"; nocase;
pcre:"/^((?!(?i:<\/object>)).)+?data\s*?\=\s*?[\x22\x27][^\x22\x27]*[?&]callback=CWS[a-zA-Z0-9_\.\x0d\x0a]{50,}+[&\x22\x27]/Rsi";
reference:url,miki.it/blog/2014/7/8/abusing-jsonp-with-rosetta-flash/;
reference:cve,2014-4671;
classtype:attempted-user;
sid:2018656; rev:3;
metadata:affected_product Web_Browsers, affected_product Web_Browser_Plugins, attack_target Client_Endpoint, created_at 2014_07_09, cve CVE_2014_4671, deployment Perimeter, signature_severity Major, tag Web_Client_Attacks, updated_at 2019_10_08;
)