shtml attachment files ?

[mailscanner at barendse.to]

On Thu, 28 Jul 2022, Shawn Iverson via MailScanner wrote:

> shtml should be safe to block

Thanks!!  Have added the below to my filename.rules.conf

deny    \.shtml$        Possible server side include attack 
SHTML files can be used with a server side include attack


> In the case of .html, you can use some additional regex if the names have a 
> certain unique characteristic. Just not msg-.*.html. That will block legit 
> mail.
>
> On 7/28/22 08:14, mailscanner at barendse.to wrote:
>> Hi list
>> 
>> I tried blocking \.htm$ and \.html$ in my filename.rules.conf before but 
>> found that this effectively blocked nearly each and every email that was 
>> coming in so I have to allow that for as long as MailScanner cannot 
>> differentiate between an attached .html file or html text in the mail 
>> itself
>> 
>> Just received another fake/phishing email with an .shtml attachment which 
>> includes server side includes google taught me.
>> 
>> Would it be OK to block that or will I also lose mail? If, then maybe it's 
>> a good addition to the standard MS filename rules?
>> 
>> Thanks!
>> 
>> 
>
>
> -- 
> MailScanner mailing list
> mailscanner at lists.mailscanner.info
> http://lists.mailscanner.info/mailman/listinfo/mailscanner
>
>