Velocity Application Errors Indicating Potential Server-Side Template Injection
Detects Velocity template rendering exceptions in application error logs that may indicate user-influenced SSTI attempts.
- Product
- velocity
- Category
- application
- Author
- Moti Harmats (SigmaHQ), DRL 1.1
- Published
- 2023-02-11
- Updated
- 2026-07-31
ATT&CK techniques
Initial AccessRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags application error log events that include Velocity rendering exceptions such as ParseErrorException, VelocityException, and TemplateInitException. Such errors can indicate malformed or attacker-controlled template content being processed, which is important because server-side template injection may allow unintended code or template evaluation. The detection relies on collected Velocity application error logs that include ERROR-level entries containing these exception keywords.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Velocity Application Errors Indicating Potential Server-Side Template Injection
id: 932c9f1a-4a62-4704-acd2-7bcec083eb74
status: test
description: This rule flags application error log events that include Velocity rendering exceptions such as ParseErrorException, VelocityException, and TemplateInitException. Such errors can indicate malformed or attacker-controlled template content being processed, which is important because server-side template injection may allow unintended code or template evaluation. The detection relies on collected Velocity application error logs that include ERROR-level entries containing these exception keywords.
references:
- https://antgarsil.github.io/posts/velocity/
- https://www.wix.engineering/post/threat-and-vulnerability-hunting-with-application-server-error-logs
- https://github.com/SigmaHQ/sigma/blob/master/rules/application/velocity/velocity_ssti_injection.yml
author: Moti Harmats, Huntrule Team
date: 2023-02-11
tags:
- attack.initial-access
- attack.t1190
logsource:
category: application
product: velocity
definition: "Requirements: application error logs must be collected (with LOG_LEVEL=ERROR and above)"
detection:
keywords:
- ParseErrorException
- VelocityException
- TemplateInitException
condition: keywords
falsepositives:
- Application bugs
- Missing .vm files
level: high
license: DRL-1.1
related:
- id: 16c86189-b556-4ee8-b4c7-7e350a195a4f
type: derived