Expression Language Injection (EL Injection)

Detects user-controlled input evaluated by Java EL, Spring SpEL, Thymeleaf, or JSP Expression Language.

zakirkun cf3f64e 2 files · 2.4 KB Updated

File contents

Expression Language Injection

Overview

Expression Language (EL) injection allows attackers to execute arbitrary expressions in server-side template engines. Famous CVEs include Spring4Shell (CVE-2022-22965) and Struts RCE vulnerabilities.

Affected technologies:

  • Spring SpEL: #{T(java.lang.Runtime).getRuntime().exec('id')}
  • Thymeleaf: __${T(java.lang.Runtime).getRuntime().exec('id')}__
  • JSP EL: ${Runtime.exec('id')}

Remediation

  • Never pass user input to ExpressionParser.parseExpression()
  • Use SimpleEvaluationContext instead of StandardEvaluationContext
  • Disable SpEL evaluation in Thymeleaf templates when not needed

zakirkun/ice-tea/tree/main/skills/injection/expression-language-injection commit cf3f64e819

Frequently asked questions

npx skillmds@latest add zakirkun/expression-language-injection-el-injection