Spring application logs: Potential SpEL injection causing ExpressionException errors

Alerts on Spring ExpressionException errors that may indicate potential SpEL injection attempts.

FreeUnreviewedSigmahighv1

spring-application-logs-potential-spel-injection-causing-expressionexception-err-e9edd087

title: "Spring application logs: Potential SpEL injection causing ExpressionException errors"
id: 9df87070-8ba1-4538-bd0d-77ec88e6a308
status: test
description: This rule flags Spring application error logs containing org.springframework.expression.ExpressionException, which can indicate attempted exploitation of Spring Expression Language (SpEL). Such inputs may be used by attackers to trigger expression parsing and potentially progress toward code execution. The detection relies on collected application error logs at ERROR level or higher.
references:
  - https://owasp.org/www-community/vulnerabilities/Expression_Language_Injection
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/spring/spring_spel_injection.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: spring
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - org.springframework.expression.ExpressionException
  condition: keywords
falsepositives:
  - Application bugs
level: high
license: DRL-1.1
related:
  - id: e9edd087-89d8-48c9-b0b4-5b9bb10896b8
    type: derived

What it detects

This rule flags Spring application error logs containing org.springframework.expression.ExpressionException, which can indicate attempted exploitation of Spring Expression Language (SpEL). Such inputs may be used by attackers to trigger expression parsing and potentially progress toward code execution. The detection relies on collected application error logs at ERROR level or higher.

Known false positives

Application bugs

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.