Floci API Gateway VTL RCE - SSTI via responseTemplate MOCK Integration (IAM Bypass)

Ibrahim Saud@tektrix

•updated Jun 29, 2026•0•0•4

Detects attempts to exploit Velocity Template Language (VTL) injection vulnerabilities in the Floci API Gateway, specifically targeting MOCK integration configurations on port 4566. The rule monitors for the injection of malicious Java objects via response templates, deployment of these templates, and the execution of the RCE payload via a specific API endpoint path, including potential IAM enforcement bypass attempts.