Velocity Template Renderer Exceptions Indicating Possible SSTI via ParseErrorException

title: Velocity Template Renderer Exceptions Indicating Possible SSTI via ParseErrorException
id: 932c9f1a-4a62-4704-acd2-7bcec083eb74
status: test
description: "This rule flags application error log entries containing Velocity template renderer exceptions: ParseErrorException, VelocityException, or TemplateInitException. Such exceptions can occur when templates are initialized or parsed using unexpected or user-influenced input, which attackers may leverage for server-side template injection. It relies on application error logging from the Velocity environment at error level or higher to surface these exception messages."
references:
  - https://antgarsil.github.io/posts/velocity/
  - https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
  - https://github.com/SigmaHQ/sigma/blob/master/rules/application/velocity/velocity_ssti_injection.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
  - attack.initial-access
  - attack.t1190
logsource:
  category: application
  product: velocity
  definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
  keywords:
    - ParseErrorException
    - VelocityException
    - TemplateInitException
  condition: keywords
falsepositives:
  - Application bugs
  - Missing .vm files
level: high
license: DRL-1.1
related:
  - id: 16c86189-b556-4ee8-b4c7-7e350a195a4f
    type: derived