Nasreddine Bencherchali
32 lines
966 B
YAML
32 lines
966 B
YAML
title: Java Payload Strings
|
|
id: 583aa0a2-30b1-4d62-8bf3-ab73689efe6c
|
|
status: experimental
|
|
description: Detects possible Java payloads in web access logs
|
|
author: frack113
|
|
date: 2022/06/04
|
|
modified: 2022/06/14
|
|
references:
|
|
- https://www.rapid7.com/blog/post/2022/06/02/active-exploitation-of-confluence-cve-2022-26134/
|
|
- https://www.rapid7.com/blog/post/2021/09/02/active-exploitation-of-confluence-server-cve-2021-26084/
|
|
- https://github.com/httpvoid/writeups/blob/62d3751945289d088ccfdf4d0ffbf61598a2cd7d/Confluence-RCE.md
|
|
- https://twitter.com/httpvoid0x2f/status/1532924261035384832
|
|
logsource:
|
|
category: webserver
|
|
detection:
|
|
keywords:
|
|
- '%24%7B%28%23a%3D%40'
|
|
- '${(#a=@'
|
|
- '%24%7B%40java'
|
|
- '${@java'
|
|
- 'u0022java'
|
|
- '%2F%24%7B%23'
|
|
- '/${#'
|
|
- 'new+java.'
|
|
condition: keywords
|
|
falsepositives:
|
|
- Legitimate apps
|
|
level: high
|
|
tags:
|
|
- cve.2022.26134
|
|
- cve.2021.26084
|