{"id":"4d0af518-828e-4a04-a751-a7d03f3046ad","title":"Potential OGNL Injection Exploitation In JVM Based Application","description":"Detects potential OGNL Injection exploitation, which may lead to RCE.\nOGNL is an expression language that is supported in many JVM based systems.\nOGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)\n","author":"Moti Harmats","status":"test","level":"high","date":"2023-02-11","modified":"","tags":["attack.initial-access","attack.t1190","cve.2017-5638","cve.2022-26134"],"technique_ids":["T1190"],"logsource":{"category":"application","product":"jvm","definition":"Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"},"falsepositives":["Application bugs"],"references":["https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs"],"source_path":"rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","source_sha256":"7582d0b53d70580574eefdd40ecf018ce80c24443fde8a5484b64862bd948795","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/jvm/java_ognl_injection_exploitation_attempt.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Potential OGNL Injection Exploitation In JVM Based Application\nid: 4d0af518-828e-4a04-a751-a7d03f3046ad\nstatus: test\ndescription: |\n    Detects potential OGNL Injection exploitation, which may lead to RCE.\n    OGNL is an expression language that is supported in many JVM based systems.\n    OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)\nreferences:\n    - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs\nauthor: Moti Harmats\ndate: 2023-02-11\ntags:\n    - attack.initial-access\n    - attack.t1190\n    - cve.2017-5638\n    - cve.2022-26134\nlogsource:\n    category: application\n    product: jvm\n    definition: 'Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)'\ndetection:\n    keywords:\n        - 'org.apache.commons.ognl.OgnlException'\n        - 'ExpressionSyntaxException'\n    condition: keywords\nfalsepositives:\n    - Application bugs\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1190","id":"T1190","name":"Exploit Public-Facing Application","page":"techniques/enterprise/T1190/"}],"data_path":"data/detection-rules/4d0af518-828e-4a04-a751-a7d03f3046ad.json","kind":"sigma"}