mirror of
https://github.com/splunk/security_content
synced 2026-06-08 17:32:49 +00:00
Haag Story 3: Attack Analytics to the Rescue
"There's a snake in my Tomcat!" When malicious serialized objects started showing up at Sunnyside Server Farm, Security Sheriff Haag rounded up a posse of new detections to keep the web applications safe. This PR delivers: - Two new best friends: tomcat_session_file_upload_attempt and tomcat_session_deserialization_attempt - A brand new playset: "Apache Tomcat Session Deserialization Attacks" analytic story - No more crying when the bad toys try to upload .session files - The claw of justice comes down when suspicious JSESSIONID cookies appear Remember what Security Ranger Haag always says: "To HTTP response codes and beyond!"
This commit is contained in:
Michael Haag
@@ -0,0 +1,78 @@
|
||||
name: Tomcat Session Deserialization Attempt
|
||||
id: e28b4fd4-8f5a-41cd-8222-2f1ccca53ef1
|
||||
version: 1
|
||||
date: '2025-03-25'
|
||||
author: Michael Haag, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the second stage of the attack. This phase occurs when an attacker attempts to trigger deserialization of a previously uploaded malicious session file by sending a GET request with a specially crafted JSESSIONID cookie. These requests typically have specific characteristics, including a JSESSIONID cookie with a leading dot that matches a previously uploaded filename, and typically result in a HTTP 500 error when the exploitation succeeds.
|
||||
data_source:
|
||||
- Nginx Access
|
||||
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
|
||||
where Web.http_method=GET AND Web.cookie="*JSESSIONID=.*" AND Web.status=500
|
||||
by Web.src, Web.dest, Web.http_user_agent, Web.uri_path, Web.cookie, Web.status
|
||||
| `drop_dm_object_name("Web")`
|
||||
| where match(cookie, "^JSESSIONID=\.")
|
||||
| rex field=cookie "JSESSIONID=\.(?<cookie_path>[^;]+)"
|
||||
| eval severity="High"
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `tomcat_session_deserialization_attempt_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting logs from your web servers, proxies, or WAFs that process web traffic to Tomcat instances. The data must be mapped to the Web datamodel in the Web node. Ensure your web servers are logging requests that include HTTP methods, status codes, URI paths, and cookie information. Particularly important is capturing the JSESSIONID cookie values. The detection specifically looks for GET requests with a JSESSIONID cookie that starts with a dot (.) and results in a 500 status code, which is characteristic of successful deserialization attempts.
|
||||
known_false_positives: Limited false positives should occur as this pattern is highly specific to CVE-2025-24813 exploitation. However, legitimate application errors that use similar cookie patterns and result in 500 status codes might trigger false positives. Review the JSESSIONID cookie format and the associated request context to confirm exploitation attempts.
|
||||
references:
|
||||
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-24813
|
||||
- https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
|
||||
- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
|
||||
- https://gist.github.com/MHaggis/e106367f6649fbb09ab27e7b4a01cf73
|
||||
drilldown_searches:
|
||||
- name: View the detection results for - "$src$"
|
||||
search: '%original_detection_search% | search src = "$src$"'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View risk events for the last 7 days for - "$src$"
|
||||
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
|
||||
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
|
||||
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
|
||||
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
|
||||
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View suspicious JSESSIONID cookies
|
||||
search: '%original_detection_search% | fields + uri_path, cookie, status'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
rba:
|
||||
message: A Tomcat session deserialization attempt has been detected from IP $src$ targeting $dest$ with a suspicious JSESSIONID cookie. This could indicate exploitation of CVE-2025-24813.
|
||||
risk_objects:
|
||||
- field: src
|
||||
type: system
|
||||
score: 80
|
||||
- field: dest
|
||||
type: system
|
||||
score: 80
|
||||
threat_objects:
|
||||
- field: src
|
||||
type: ip_address
|
||||
tags:
|
||||
analytic_story:
|
||||
- Apache Tomcat Session Deserialization Attacks
|
||||
asset_type: Web Application
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
- T1505.003
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
cve:
|
||||
- CVE-2025-24813
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access.log
|
||||
sourcetype: nginx:plus:kv
|
||||
source: nginx
|
||||
@@ -0,0 +1,77 @@
|
||||
name: Tomcat Session File Upload Attempt
|
||||
id: a1d8f5c3-9b7e-4f2d-8c51-3bca5e672410
|
||||
version: 1
|
||||
date: '2025-03-25'
|
||||
author: Michael Haag, Splunk
|
||||
status: production
|
||||
type: Anomaly
|
||||
description: This detection identifies potential exploitation of CVE-2025-24813 in Apache Tomcat through the initial stage of the attack. This first phase occurs when an attacker attempts to upload a malicious serialized Java object with a .session file extension via an HTTP PUT request. When successful, these uploads typically result in HTTP status codes 201 (Created) or 409 (Conflict) and create the foundation for subsequent deserialization attacks by placing malicious content in a location where Tomcat's session management can access it.
|
||||
data_source:
|
||||
- Nginx Access
|
||||
search: '| tstats count min(_time) as firstTime max(_time) as lastTime from datamodel=Web
|
||||
where Web.http_method=PUT AND Web.uri_path="*.session" AND (Web.status=201 OR Web.status=409)
|
||||
by Web.src, Web.dest, Web.http_user_agent, Web.uri_path, Web.status
|
||||
| `drop_dm_object_name("Web")`
|
||||
| rex field=uri_path "/(?<filename>[^/]+)\.session$"
|
||||
| eval severity="High"
|
||||
| `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`
|
||||
| `tomcat_session_file_upload_attempt_filter`'
|
||||
how_to_implement: To successfully implement this search, you need to be ingesting logs from your web servers, proxies, or WAFs that process web traffic to Tomcat instances. The data must be mapped to the Web datamodel in the Web node. Ensure your web servers are logging HTTP PUT requests, including status codes and URI paths. This detection specifically looks for PUT requests targeting files with a .session extension that result in HTTP status codes 201 or 409, which indicate successful creation of files - a pattern consistent with the first stage of CVE-2025-24813 exploitation.
|
||||
known_false_positives: Some legitimate applications might use PUT requests to create .session files, especially in custom implementations that leverage Tomcat's session persistence mechanism. Verify if the detected activity is part of a normal application flow or if it correlates with other suspicious behavior, such as subsequent GET requests with manipulated JSESSIONID cookies.
|
||||
references:
|
||||
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-24813
|
||||
- https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
|
||||
- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
|
||||
- https://gist.github.com/MHaggis/e106367f6649fbb09ab27e7b4a01cf73
|
||||
drilldown_searches:
|
||||
- name: View the detection results for - "$src$"
|
||||
search: '%original_detection_search% | search src = "$src$"'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View risk events for the last 7 days for - "$src$"
|
||||
search: '| from datamodel Risk.All_Risk | search normalized_risk_object IN ("$src$")
|
||||
starthoursago=168 | stats count min(_time) as firstTime max(_time) as lastTime
|
||||
values(search_name) as "Search Name" values(risk_message) as "Risk Message" values(analyticstories)
|
||||
as "Analytic Stories" values(annotations._all) as "Annotations" values(annotations.mitre_attack.mitre_tactic)
|
||||
as "ATT&CK Tactics" by normalized_risk_object | `security_content_ctime(firstTime)`
|
||||
| `security_content_ctime(lastTime)`'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
- name: View all PUT requests to .session files
|
||||
search: '%original_detection_search% | fields + uri_path, status, dest'
|
||||
earliest_offset: $info_min_time$
|
||||
latest_offset: $info_max_time$
|
||||
rba:
|
||||
message: A Tomcat session file upload attempt has been detected from IP $src$ targeting $dest$ with a suspicious .session file. This could indicate the first stage of CVE-2025-24813 exploitation.
|
||||
risk_objects:
|
||||
- field: src
|
||||
type: system
|
||||
score: 70
|
||||
- field: dest
|
||||
type: system
|
||||
score: 70
|
||||
threat_objects:
|
||||
- field: src
|
||||
type: ip_address
|
||||
tags:
|
||||
analytic_story:
|
||||
- Apache Tomcat Session Deserialization Attacks
|
||||
asset_type: Web Application
|
||||
mitre_attack_id:
|
||||
- T1190
|
||||
- T1505.003
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
security_domain: network
|
||||
cve:
|
||||
- CVE-2025-24813
|
||||
tests:
|
||||
- name: True Positive Test
|
||||
attack_data:
|
||||
- data: https://media.githubusercontent.com/media/splunk/attack_data/master/datasets/attack_techniques/T1190/tomcat/tomcat_nginx_access.log
|
||||
sourcetype: nginx:plus:kv
|
||||
source: nginx
|
||||
@@ -0,0 +1,23 @@
|
||||
name: Apache Tomcat Session Deserialization Attacks
|
||||
id: 1a0f125a-0f65-44fc-a96f-576d53d69478
|
||||
version: 1
|
||||
status: production
|
||||
date: '2025-03-25'
|
||||
author: Michael Haag, Splunk
|
||||
description: This analytic story addresses critical vulnerabilities in Apache Tomcat that allow attackers to achieve remote code execution through session deserialization attacks. These attacks exploit path equivalence issues in Tomcat's session handling mechanisms, particularly when configured with writable DefaultServlet and file-based session persistence, enabling attackers to upload and execute malicious serialized objects through manipulated session files.
|
||||
narrative: 'Apache Tomcat''s session management functionality can be exploited when specific configurations are present, particularly involving the DefaultServlet and file-based session persistence. Attackers leverage this by first uploading a malicious serialized object disguised as a session file through an HTTP PUT request. Once the file is uploaded, they manipulate the JSESSIONID cookie to reference this malicious file, forcing Tomcat to deserialize the content and potentially execute arbitrary code. The attack typically manifests in two stages: an initial PUT request that successfully creates a .session file, followed by a GET request with a specially crafted JSESSIONID cookie that triggers the deserialization. This technique has been observed in real-world attacks where threat actors exploit vulnerable Tomcat installations to establish persistent access and execute malicious code on the target system. The detections in this story focus on identifying both stages of this attack pattern, allowing defenders to detect and respond to exploitation attempts before they succeed.'
|
||||
references:
|
||||
- https://lists.apache.org/thread/j5fkjv2k477os90nczf2v9l61fb0kkgq
|
||||
- https://nvd.nist.gov/vuln/detail/CVE-2025-24813
|
||||
- https://github.com/vulhub/vulhub/tree/master/tomcat/CVE-2025-24813
|
||||
- https://www.rapid7.com/db/vulnerabilities/apache-tomcat-cve-2025-24813/
|
||||
tags:
|
||||
category:
|
||||
- Adversary Tactics
|
||||
product:
|
||||
- Splunk Enterprise
|
||||
- Splunk Enterprise Security
|
||||
- Splunk Cloud
|
||||
usecase: Advanced Threat Detection
|
||||
cve:
|
||||
- CVE-2025-24813
|
||||
Reference in New Issue
Block a user