Web Server SSTI Probe Strings in GET Requests

Flags GET requests containing SSTI probe strings in web access logs when the response is not 404.

FreeUnreviewedSigmahighv1

web-server-ssti-probe-strings-in-get-requests-ada3bc4f

title: Web Server SSTI Probe Strings in GET Requests
id: c0faa4a1-ec86-4b3d-9d84-7667e7829184
status: test
description: This rule matches web requests using the GET method that contain common Server-Side Template Injection (SSTI) probe patterns in access logs. SSTI attempts matter because attackers may be trying to evaluate server-side expressions to access sensitive data or execute code in the application context. Detection relies on HTTP method and specific SSTI-related substrings, excluding events with a 404 status.
references:
  - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
  - https://github.com/payloadbox/ssti-payloads
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_ssti_in_access_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-14
tags:
  - attack.stealth
  - attack.t1221
logsource:
  category: webserver
detection:
  select_method:
    cs-method: GET
  keywords:
    - ={{
    - =%7B%7B
    - =${
    - =$%7B
    - =<%=
    - =%3C%25=
    - =@(
    - freemarker.template.utility.Execute
    - .getClass().forName('javax.script.ScriptEngineManager')
    - T(org.apache.commons.io.IOUtils)
  filter:
    sc-status: 404
  condition: select_method and keywords and not filter
falsepositives:
  - User searches in search boxes of the respective website
  - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes
level: high
license: DRL-1.1
related:
  - id: ada3bc4f-f0fd-42b9-ba91-e105e8af7342
    type: derived

What it detects

This rule matches web requests using the GET method that contain common Server-Side Template Injection (SSTI) probe patterns in access logs. SSTI attempts matter because attackers may be trying to evaluate server-side expressions to access sensitive data or execute code in the application context. Detection relies on HTTP method and specific SSTI-related substrings, excluding events with a 404 status.

Known false positives

User searches in search boxes of the respective website
Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.