Potential OGNL Injection Exploitation In JVM Based Application

Rule Info

Name

Potential OGNL Injection Exploitation In JVM Based Application

Author

Moti Harmats

Description

Detects potential OGNL Injection exploitation, which may lead to RCE. OGNL is an expression language that is supported in many JVM based systems. OGNL Injection is the reason for some high profile RCE's such as Apache Struts (CVE-2017-5638) and Confluence (CVE-2022-26134)

Reference

https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs

Date

2023-02-11 00:00:00

Modified

None

4d0af518-828e-4a04-a751-a7d03f3046ad