Expression Language Injection
Overview
Expression Language (EL) injection allows attackers to execute arbitrary expressions in server-side template engines. Famous CVEs include Spring4Shell (CVE-2022-22965) and Struts RCE vulnerabilities.
Affected technologies:
- Spring SpEL:
#{T(java.lang.Runtime).getRuntime().exec('id')} - Thymeleaf:
__${T(java.lang.Runtime).getRuntime().exec('id')}__ - JSP EL:
${Runtime.exec('id')}
Remediation
- Never pass user input to
ExpressionParser.parseExpression() - Use
SimpleEvaluationContextinstead ofStandardEvaluationContext - Disable SpEL evaluation in Thymeleaf templates when not needed