- 重要な情報
- アプリ内
- インフラストラクチャー
- アプリケーションパフォーマンス
- 継続的インテグレーション
- ログ管理
- セキュリティ
- UX モニタリング
- 管理
Classification:
attack
Detect attempts to exploit the spring4shell vulnerability (CVE-2022-22963).
Monitor payload matching the known patterns for the Spring core RCE known as Spring4shell (event rule: #dog-000-004) triggering on Java applications @language:(jvm OR java)
and generate an Application Security signal with Medium
severity.
A backup condition that looks for existing rules (@appsec.type:java_code_injection
) that trigger on the key that is used in the exploit (@appsec.triggers.rule_matches.parameters.key_path:class.module.classLoader.*
).
Consider blocking the attacking IP(s) temporarily to prevent them to reach deeper parts of your production systems.
If you are using Spring framework (v5.3.0 to 5.3.17, 5.2.0 to 5.2.19, and older versions) on JDK9+ and packaged it as WAR on Apache Tomcat, there is a high chance that you are vulnerable and need to do one of the following.