id: spring-framework-exceptions

info:
  name: Spring Framework Exceptions
  description: Detects suspicious Spring framework exceptions that could indicate exploitation attempts
  author: geeknik
  reference:
    - https://docs.spring.io/spring-security/site/docs/current/apidocs/overview-tree.html
  severity: medium
  tags: file,logs,spring

file:
  - extensions:
      - all

    extractors:
      - type: regex
        name: exception
        part: body
        regex:
          - 'AccessDeniedException'
          - 'CsrfException'
          - 'InvalidCsrfTokenException'
          - 'MissingCsrfTokenException'
          - 'CookieTheftException'
          - 'InvalidCookieException'
          - 'RequestRejectedException'