Security Glossary

Expression Language Injection

A class of vulnerabilities where attackers inject code into expression languages (like JSP EL, SpEL, or OGNL) used by web frameworks to execute arbitrary code.

Expression Language Injection (EL Injection) is a class of vulnerabilities where attackers inject code into expression languages used by web frameworks. These languages are designed to access data and call methods, making them powerful attack vectors when user input is evaluated.

Common Expression Languages

  • JSP/JSF EL: Java EE unified expression language
  • SpEL: Spring Expression Language
  • OGNL: Object-Graph Navigation Language (Struts)
  • MVEL: MVFLEX Expression Language
  • JEXL: Java Expression Language

JSP/JSTL EL Example

<!-- Vulnerable: EL evaluated in template -->
${param.input}

<!-- Plain JSP/JSTL EL cannot call arbitrary Java. -->
<!-- It resolves implicit objects and scoped attributes, -->
<!-- so the impact is information disclosure: -->
${applicationScope}
${sessionScope.user.password}
${pageContext.request.getServletContext()}

SpEL / OGNL RCE Example

<!-- Spring Expression Language (SpEL) can invoke methods -->
${T(java.lang.Runtime).getRuntime().exec('id')}

<!-- OGNL (as abused in Struts) uses %{...} -->
%{(#rt=@java.lang.Runtime@getRuntime()).exec('id')}

Detection

# Test for EL evaluation
${7*7}           # Returns 49
#{7*7}           # Alternative syntax
%{7*7}           # OGNL syntax

# Identify the engine
${T(java.lang.System).getenv()}  # SpEL
%{#context}                        # OGNL

Impact

  • Remote code execution
  • Access to server-side objects and data
  • Authentication bypass
  • Information disclosure

Mitigation

  • Never evaluate user input as an expression.
  • If SpEL is required, use a SimpleEvaluationContext, which disables type references (T(...)) and arbitrary method invocation, instead of a StandardEvaluationContext.

See Also