Open redirect: Staples SSO authentication

calendar Oct 7, 2026  ·
Share on: linkedin copy

Detects inbound messages containing links that abuse the Staples.ca SSO authentication endpoint (/sso/auth) with a Redirect_URI parameter pointing to a domain other than staples.ca. This open redirect pattern is often leveraged to lend legitimacy to malicious destination URLs. The rule excludes messages where the sender's domain is staples.ca or a highly trusted root domain and the message passes DMARC authentication.

Sublime rule (View on GitHub)

 1name: "Open redirect: Staples SSO authentication"
 2description: "Detects inbound messages containing links that abuse the Staples.ca SSO authentication endpoint (/sso/auth) with a Redirect_URI parameter pointing to a domain other than staples.ca. This open redirect pattern is often leveraged to lend legitimacy to malicious destination URLs. The rule excludes messages where the sender's domain is staples.ca or a highly trusted root domain and the message passes DMARC authentication."
 3type: "rule"
 4severity: "medium"
 5source: |
 6  type.inbound
 7  and any(body.links,
 8          .href_url.domain.root_domain == "staples.ca"
 9          and strings.icontains(.href_url.path, '/sso/auth')
10          and strings.icontains(.href_url.query_params, 'Redirect_URI=')
11          // make sure it's not redirecting back to staples.ca
12          and not regex.icontains(.href_url.query_params,
13                                  'redirect_uri=(?:https?(?:%3a|:))?(?:%2f|\/)*[^&]*staples\.ca(?:&|\/|$|%2f)'
14          )
15  )
16  and not (
17    sender.email.domain.root_domain == "staples.ca"
18    and coalesce(headers.auth_summary.dmarc.pass, false)
19  )
20  // negate highly trusted sender domains unless they fail DMARC authentication
21  and not (
22    sender.email.domain.root_domain in $high_trust_sender_root_domains
23    and coalesce(headers.auth_summary.dmarc.pass, false)
24  )  
25attack_types:
26  - "Credential Phishing"
27tactics_and_techniques:
28  - "Open redirect"
29  - "Impersonation: Brand"
30detection_methods:
31  - "URL analysis"
32  - "Header analysis"
33id: "06b0a12c-40cb-5e68-b66a-d2129cd0294e"
to-top