Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)

title: Web Server GET Requests Containing SSTI Payload Strings (Server-Side Template Injection)
id: c0faa4a1-ec86-4b3d-9d84-7667e7829184
status: test
description: This rule identifies potential server-side template injection attempts in web server access logs by matching GET requests that contain common SSTI payload patterns. Attackers may use these strings to trigger server-side template evaluation and execute unintended logic or code. The detection relies on HTTP method and specific keyword fragments in logged request data, and it excludes matches where the server response status is 404.
references:
  - https://book.hacktricks.xyz/pentesting-web/ssti-server-side-template-injection
  - https://github.com/payloadbox/ssti-payloads
  - https://github.com/SigmaHQ/sigma/blob/master/rules/web/webserver_generic/web_ssti_in_access_logs.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-14
tags:
  - attack.stealth
  - attack.t1221
logsource:
  category: webserver
detection:
  select_method:
    cs-method: GET
  keywords:
    - ={{
    - =%7B%7B
    - =${
    - =$%7B
    - =<%=
    - =%3C%25=
    - =@(
    - freemarker.template.utility.Execute
    - .getClass().forName('javax.script.ScriptEngineManager')
    - T(org.apache.commons.io.IOUtils)
  filter:
    sc-status: 404
  condition: select_method and keywords and not filter
falsepositives:
  - User searches in search boxes of the respective website
  - Internal vulnerability scanners can cause some serious FPs when used, if you experience a lot of FPs due to this think of adding more filters such as "User Agent" strings and more response codes
level: high
license: DRL-1.1
related:
  - id: ada3bc4f-f0fd-42b9-ba91-e105e8af7342
    type: derived