Expression Language Injection (EL Injection)

Detects user-controlled input evaluated by Java EL, Spring SpEL, Thymeleaf, or JSP Expression Language.

zakirkun Updated

File contents

Expression Language Injection

Overview

Expression Language (EL) injection allows attackers to execute arbitrary expressions in server-side template engines. Famous CVEs include Spring4Shell (CVE-2022-22965) and Struts RCE vulnerabilities.

Affected technologies:

  • Spring SpEL: #{T(java.lang.Runtime).getRuntime().exec('id')}
  • Thymeleaf: __${T(java.lang.Runtime).getRuntime().exec('id')}__
  • JSP EL: ${Runtime.exec('id')}

Remediation

  • Never pass user input to ExpressionParser.parseExpression()
  • Use SimpleEvaluationContext instead of StandardEvaluationContext
  • Disable SpEL evaluation in Thymeleaf templates when not needed

zakirkun/ice-tea/tree/main/skills/injection/expression-language-injection commit cf3f64e819

Frequently asked questions

npx skillmds@latest add zakirkun/expression-language-injection-el-injection