{
  "version": "Notebook/1.0",
  "items": [
    {
      "type": 1,
      "content": {
        "json": "# Expression Language Injection Runbook\n\nExpression Language Injection works by taking advantage of server-side code injection vulnerabilities which occur whenever an application incorporates user-controllable data into a string that is dynamically evaluated by a code interpreter. This can lead to complete compromise of the application's data and functionality, as well as the server that is hosting the application.\n\n\nExample Event - Exploited outcome Expression Language Injection  \n`Oct 22 2024 12:09:18.532-0600 192.168.12.70 CEF:0|Contrast Security|Contrast Agent Java|6.5.4|SECURITY|The parameter message had a value that successfully exploited expression-language-injection - T(java.lang.Runtime).getRuntime().exec(\"whoami\")|WARN|pri=expression-language-injection src=0:0:0:0:0:0:0:1 spt=8080 request=/hello requestMethod=GET app=webapplication outcome=EXPLOITED`  \n  \n  \n\nExample Event - Blocked outcome Expression Language Injection  \n`Oct 22 2024 12:14:22.969-0600 192.168.12.70 CEF:0|Contrast Security|Contrast Agent Java|6.5.4|SECURITY|The parameter message had a value that successfully exploited expression-language-injection - T(java.lang.Runtime).getRuntime().exec(\"whoami\")|WARN|pri=expression-language-injection src=0:0:0:0:0:0:0:1 spt=8080 request=/hello requestMethod=GET app=webapplication outcome=BLOCKED`\n  \n  \n\n\nWhat is the “outcome” of the event you are triaging? (click to proceed)  \n\n\n\n"
      },
      "name": "text - 0"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "bullets",
        "links": [
          {
            "id": "13537818-d586-43a4-a87f-ad664f670754",
            "cellValue": "text - 1",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Exploited",
            "style": "link"
          },
          {
            "id": "a48af7b2-67f0-4397-94f4-2f2126477b44",
            "cellValue": "text - 4",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Blocked",
            "style": "link"
          },
          {
            "id": "6b58baab-561b-44f9-9dfb-759e8daa92a9",
            "cellValue": "text - 5",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Ineffective",
            "style": "link"
          },
          {
            "id": "7ff38bea-4a89-45f8-874c-af9d28c744f8",
            "cellValue": "text - 6",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Success",
            "style": "link"
          }
        ]
      },
      "name": "links - 3"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Exploited](#Specific Section)\n\nAn \"Exploited\" outcome indicates that Contrast detected an input entering an application that resembled Expression Language Injection. It then confirmed that this input was utilized in the evaluation of the expression language.  \n\nTo verify this is a true positive, review the following attributes of the event for common indicators:  \n\n- Does the payload contain references to Java classes or methods?\n- Does the payload contain os commands?\n- Does the payload contain template engine expressions? (e.g. ${...}, #{...}, *{...})\n- Is the IP address from a pentester or known vulnerability scanner IP?\n- Are there application logs with template engine related error messages around the same timestamp as the event?\n\n\n\nExamples:\n\n- `T(java.lang.Runtime).getRuntime().exec(\"whoami\")`\n- `${pageContext.request.getSession().setAttribute(\"admin\",true)}`\n- `*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec('id').getInputStream())}`  \n\nDoes the event appear to be a true positive? (click to proceed)"
      },
      "name": "text - 1"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "bullets",
        "links": [
          {
            "id": "b81eafea-442c-440f-b906-8c24456f5a56",
            "cellValue": "Exploited True Positive",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "No",
            "style": "link"
          },
          {
            "id": "3ae6e50a-18e2-43c5-80a9-4426acd82f77",
            "cellValue": "Exploited False Positive",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Yes, or unsure",
            "style": "link"
          }
        ]
      },
      "name": "links - 8"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Blocked](#Specific Section)\n\nA \"Blocked\" outcome indicates that Contrast detected an input entering an application that resembled Expression Language Injection. It then confirmed that this input was going to be evaluated by the expression language and therefore blocked it.  \n\nTo verify this is a true positive, review the following attributes of the event:\n\n- Does the payload contain references to Java classes or methods?\n- Does the payload contain os commands?\n- Does the payload contain template engine expressions? (e.g. ${...}, #{...}, *{...})\n- Is the IP address from a pentester or known vulnerability scanner IP?\n- Are there application logs with template engine related error messages around the same timestamp as the event?\n\n\nExamples:\n\n- `T(java.lang.Runtime).getRuntime().exec(\"whoami\")`\n- `${pageContext.request.getSession().setAttribute(\"admin\",true)}`\n- `*{T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec('id').getInputStream())}`  \n\n\nIs the event a true positive? (click to proceed)\n"
      },
      "name": "text - 4"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "bullets",
        "links": [
          {
            "id": "db9b6c24-804e-4b55-a99f-174f4ac9eeb2",
            "cellValue": "Blocked False Positive",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "No",
            "style": "link"
          },
          {
            "id": "7331f254-ec3d-446e-ad1b-c2806829e8bc",
            "cellValue": "Blocked True Positive  ",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Yes, or unsure",
            "style": "link"
          }
        ]
      },
      "name": "links - 10"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Ineffective](#specific section)\n\n\"Ineffective\" means Contrast detected an input coming into an application that looked like Expression Language injection, but did not confirm that the input was used evaluated by the expression template engine. This is called a “Probe” within the Contrast UI. This event is a real attack attempt to exploit your application, but it was ineffective. Probes can indicate an attacker scanning or exploring for vulnerabilities.\n\n- Does the probe event appear to be caused by legitimate traffic and numerous similar probe events are being generated, an [exclusion](https://docs.contrastsecurity.com/en/application-exclusions.html) can be configured to clean up Contrast data.  \n- Is the probe originating from a specific ip[s] that is a real external IP address (not internal load balancer or network device) and not the public IP address for a large company network?   Consider…  \n  - Block using network appliance\n  - [Block using Contrast](https://docs.contrastsecurity.com/en/ip-management.html)\n- Are all of the events originating from the same application user account  \n  - Determine if the account is a legitimate account\n  - If so, attempt to help them recover the account by contacting and authenticating the legitimate user, arranging to change their credentials, and recover from any damage.\n  - If not,  consider the following options:\n    - Ban the account\n    - Disable the account\n    - Delete the account\n"
      },
      "name": "text - 5"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "paragraph",
        "links": [
          {
            "id": "51619ff1-9791-410f-8c0d-8d75379b5854",
            "cellValue": " Post-Incident Activities",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Proceed to Post-Incident Activities ",
            "style": "link"
          }
        ]
      },
      "name": "links - 17"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Exploited True Positive](#Specific)  \n\nIt is possible that the event is a True Positive, but is benign. A Benign True Positive is when an application relies on vulnerable behavior that could potentially be exploited, but is currently necessary for operation. This determination will often require the assistance of the development or application security teams.  \n\nIf the event appears to be a Benign True Positive, click [here](#Benign True Positive).  \n\nIf it does not appear to be a Benign True Positive, the most immediate action to stop an \"active\" attack would be to block the current attacker of the exploited event, while further triage could result in a [virtual patch](https://docs.contrastsecurity.com/en/virtual-patches.html)/[enabling block mode](https://docs.contrastsecurity.com/en/set-protect-rules.html) for the rule:  \n\n- Is the attack originating from a specific IP[s] that is a real external IP address (not internal load balancer or network device) and not the public IP address for a large company network?\n  - Block using network appliance  \n  - [Block using Contrast](https://docs.contrastsecurity.com/en/ip-management.html)  \n- Are all of the events originating from the same application user account?\n  - Determine if the account is a legitimate account  \n  - If so, attempt to help them recover the account by contacting and authenticating the legitimate user, arranging to change their credentials, and recover from any damage.\n  - If not,  consider the following options:\n    - Ban the account\n    - Disable the account\n    - Delete the account\n\nOnce the current attack has been stopped, consider taking additional steps to prevent future exploitation.  \n\n- If the only “Exploited” events for this rule are true positives, then the rule can be [switched to “Block” mode](https://docs.contrastsecurity.com/en/set-protect-rules.html) which will prevent future exploitation.  \n- If there are other “Exploited” events that appear to be legitimate, benign traffic, then “Block” mode would block those events as well, which could have negative impact to the application.  \n  - Before enabling “Block” mode for this situation, you must first exclude the legitimate, benign traffic being caught in the rule.  \n  - Alternatively, you can set up a [Virtual Patch](https://docs.contrastsecurity.com/en/virtual-patches.html) that only allows the legitimate, benign traffic through and any non-matches will be blocked.\n\nIf none of the above options are satisfactory and it's perceived the application is at great risk, you can consider shutting down the application or removing network connectivity.  \n\nPost Containment\n\n- If confirmed this is a True Positive, it should be raised with the appsec/dev teams to get fixed. Useful information for those teams would be:  \n\n  - Application name\n  - Is app in production, development, staging, etc\n  - Affected URL\n  - Attack payload\n  - Stack trace of the request\n- To better understand the extent of the incident and to ensure the attack is no longer occurring, look for other IOCs:\n  - Did the same IP Address Generate Other Alerts?\n  - Is the vulnerability being exploited by other actors?\n  - Spike in traffic or repeated access patterns to the vulnerable URL\n  - Correlate exploited events with any \"probed\" or \"blocked\" events\n  - If the attack was able to execute commands on the server, the server may need to be considered compromised and reviewed for persistence and other lateral movement.\n\n\n"
      },
      "name": "Exploited True Positive"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "paragraph",
        "links": [
          {
            "id": "5ded8c64-aabe-462b-a96f-0b5642790def",
            "cellValue": " Post-Incident Activities",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Proceed to Post-Incident Activities",
            "style": "link"
          }
        ]
      },
      "name": "links - 14 - Copy - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Exploited False Positive](#specific)  \n\nIf the event seems to be a False Positive, consider the following options:\n\n- Ignore\n- [Create Exclusion](https://docs.contrastsecurity.com/en/application-exclusions.html)\n"
      },
      "name": "Exploited False Positive"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "paragraph",
        "links": [
          {
            "id": "27278e32-0ca0-4062-872b-7d3c5fb40b11",
            "cellValue": " Post-Incident Activities",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Proceed to Post-Incident Activities",
            "style": "link"
          }
        ]
      },
      "name": "links - 14 - Copy - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Blocked True Positive](#specific)  \n\nIt is possible that the event is a True Positive, but benign. A Benign True Positive is when an application’s design relies on vulnerable behavior that could potentially be exploited, but is currently necessary for operation. This determination will often require the assistance of the development or application security teams.  \n\nIf the event appears to be a Benign True Positive, click [here](#benign-true-positive).\n\nIf it does not appear to be a Benign True Positive, consider the following options:\n\n- If one IP address is generating a lot of blocked events, it's probably worthwhile to block it.  \n- Notify Dev/Appsec team of Vulnerability. Useful information for those teams would be:  \n  - Application name\n  - Is app in production, development, staging, etc\n  - Affected URL\n  - payload\n  - Stack trace of the request  \n- Look for IOCs of further attacks in other parts/inputs of the application\n  - Other blocked or probed events?  \n  - Did anything show up as \"exploited\" indicating a different rule did not have blocking enabled?\n- Ignore\n\n  \n"
      },
      "name": "Blocked True Positive  "
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "paragraph",
        "links": [
          {
            "id": "5fdd5864-d9b1-47e1-bca7-1a036db959c1",
            "cellValue": " Post-Incident Activities",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Proceed to Post-Incident Activities",
            "style": "link"
          }
        ]
      },
      "name": "links - 14 - Copy"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Blocked False Positive](#specific)\n\nIf the event seems to be a False Positive, then Contrast may be blocking legitimate usage of the application, therefore negatively impacting it.\n\n- Create an exclusion to allow the legitimate traffic through so that you can continue to be protected by “Block” mode without the negative impact.\n- Alternatively, you can set up a Virtual Patch that only allows legitimate traffic through and any non-matches (attack traffic) will be blocked.  \n- If neither of the above options are satisfactory and the negative impact of the application must be avoided, you can switch the rule to “Monitor” mode."
      },
      "name": "Blocked False Positive"
    },
    {
      "type": 11,
      "content": {
        "version": "LinkItem/1.0",
        "style": "paragraph",
        "links": [
          {
            "id": "32415132-dc77-4859-980d-fb0a2b8b8c8e",
            "cellValue": " Post-Incident Activities",
            "linkTarget": "step",
            "linkLabel": "link",
            "preText": "Proceed to Post-Incident Activities",
            "style": "link"
          }
        ]
      },
      "name": "links - 14"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Benign True Positive](#specific)\n\nTo review, a Benign True Positive occurs when an application relies on vulnerable behavior that could potentially be exploited, but is currently necessary for operation. Consider the following options:\n\n- Ignore\n- Create Exclusion  \n- Work with the application developer on alternative implementations that do not pose such risk to the application, but meets the business needs.\n"
      },
      "name": "Benign True Positive"
    },
    {
      "type": 1,
      "content": {
        "json": "## [Post-Incident Activities](#specific)\n\n- **Documentation**\n  - **Incident Report:** Document the incident, including findings, raw events and alerts, actions taken, assets impacted, and lessons learned.\n  - **Update Documentation:** Keep security runbooks and documentation up to date.\n- **Communication**\n  - **Notify Stakeholders:** Inform relevant stakeholders about the incident and steps taken.\n  - **User Notification:** Notify affected users if there was a data breach.\n- **Review and Improve**\n  - **Review Response:** Conduct a post-mortem to review the response and identify improvement areas.\n  - **Enhance Security Posture:** Implement additional security measures and improve monitoring.  "
      },
      "name": " Post-Incident Activities"
    }
  ],
  "fallbackResourceIds": [],
  "fromTemplateId": "sentinel-ContrastADRExpressionLanguageInjection",
  "$schema": "https://github.com/Microsoft/Application-Insights-Workbooks/blob/master/schema/workbook.json"
}