- 필수 기능
- 앱 내
- 서비스 관리
- 인프라스트럭처
- 애플리케이션 성능
- 디지털 경험
- 소프트웨어 제공
- 보안
- 로그 관리
- 관리
- 인프라스트럭처
- ci
- containers
- csm
- ndm
- otel_guides
- overview
- slos
- synthetics
- tests
- 워크플로
Tactic:
Detect Java code injections attempts on web services executing OGNL expressions. Such security activity generally indicates that an attacker is trying to discover and exploit a potential OGNL code injection which can turn into a Remote Code Execution.
OGNL is an expression language that lets an application execute dynamic code in the application context. The expression starts as a string and can be made to execute. Upon execution, it is able to read or set access to Java objects available in its context, or call methods. OGNL injection is powerful and can achieve total takeover of an application.
Monitor application security events to detect OGNL payloads (@appsec.rule_id:(dog-000-002 OR dog-000-003)
) or more generic Java code injection payloads (@appsec.security_activity:attack_attempt.java_code_injection
) on distributed traces where OGNL expressions are compiled (@_dd.appsec.enrichment.has_ognl:true
).
Generate an Application Security Signal with MEDIUM
severity if the payload is OGNL specific, LOW
if generic.