NexurAI
Injection-to-RCE on the web tier: OGNL, expression-language and template abuse.
An OGNL injection in Confluence gives unauthenticated remote code execution - widely exploited to drop webshells and miners.
Atlassian Confluence Server/Data Center · 2022
The attacker sends a crafted OGNL expression in the request URI; Confluence evaluates it and runs arbitrary commands, often planting a webshell.
Alert on '${' / OGNL patterns in Confluence URIs, java (confluence) spawning shells, and new files in Confluence webroots.
Patch Confluence, hunt for shells/IOCs, and restrict external access to the app.
A crafted Content-Type header triggers OGNL expression evaluation - unauthenticated RCE, and the root cause of the Equifax breach.
Apache Struts 2 (Jakarta Multipart parser) · 2017
The attacker sends a malicious Content-Type header containing an OGNL expression; the Struts parser evaluates it and runs the embedded command.
Alert on Content-Type headers containing '%{' / 'ognl' / '(#cmd=', and Java app servers spawning shells; WAF signatures exist.
Upgrade Struts, add a WAF rule for OGNL in headers, and inventory apps using the vulnerable parser.
A data-binding flaw lets an attacker manipulate the ClassLoader via crafted request parameters, planting a webshell for RCE.
Spring Framework (data binding on JDK 9+) · 2022
The attacker sends specially crafted class.module.classLoader.* parameters to a vulnerable Spring endpoint, writing a JSP webshell to the webroot and executing commands.
Alert on requests containing 'class.module.classLoader' or 'Tomcat' pipeline params; hunt for new .jsp files and java spawning shells.
Upgrade Spring Framework (5.3.18+/5.2.20+), patch Tomcat, and add a WAF rule blocking classLoader binding.
Turn this knowledge into detections you can prove - write real rules scored on precision and recall.