Spring Framework Exceptions

Title: Spring Framework Exceptions
Status: stable
Description:Detects suspicious Spring framework exceptions that could indicate exploitation attempts
References:
  -https://docs.spring.io/spring-security/site/docs/current/api/overview-tree.html
Author: Thomas Patzke
Date: 2017-08-06
modified:2020-09-01
Tags:

• -'attack.initial-access'
• -'attack.t1190'

Logsource:

• category: application
• product: spring

Detection:
  keywords:
    - 'AccessDeniedException'
    - 'CsrfException'
    - 'InvalidCsrfTokenException'
    - 'MissingCsrfTokenException'
    - 'CookieTheftException'
    - 'InvalidCookieException'
    - 'RequestRejectedException'
  condition:keywords
Falsepositives:
  -Application bugs
Level: medium