
Summary
This rule is designed to detect potential XXE (XML External Entity) exploitation attempts in JVM-based applications by monitoring application error logs for specific exceptions that may indicate a parsing issue. The detection focuses on identifying instances of `SAXParseException` and `DOMException` which could suggest that the XML parser is improperly configured, and external entities are being processed, potentially leading to security vulnerabilities. It is crucial that applications handling XML data ensure that parsers are initialized securely to mitigate risks. The rule relies on the collection of application error logs with a log level set to ERROR or higher, which helps in identifying such issues during runtime. Successful exploitation of XXE vulnerabilities can lead to unauthorized data access, denial of service, and other security breaches, thus this detection rule serves to enhance the overall security posture of applications handling XML input.
Categories
- Application
- Web
- Infrastructure
Data Sources
- Application Log
Created: 2023-02-11