heroui logo

Potential Local File Read Vulnerability In JVM Based Application

Sigma Rules

View Source
Summary
This rule identifies potential local file read vulnerabilities in Java Virtual Machine (JVM) based applications by monitoring application error logs. The detection focuses on exceptions that are indicative of path traversal attempts, specifically those that stem from user input. If the logged error messages contain keywords such as 'FileNotFoundException' combined with illicit path patterns (e.g., '/../../..'), this suggests a potential security risk that needs attention. The rule is calibrated for logs generated at the error level, ensuring that only significant issues are flagged for review. By implementing this rule, organizations can enhance their security posture against attacks that exploit file path traversal vulnerabilities, ensuring that sensitive files are not exposed through improper handling of user inputs.
Categories
  • Application
  • Web
Data Sources
  • Application Log
Created: 2023-02-11