Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.

SKILL: Expression Language Injection — Expert Attack Playbook AI LOAD INSTRUCTION : Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, memberAccess manipulation, actuator abuse, and real world CVE chains. 0. RELATED ROUTING [ssti server side template injection](../ssti server side template injection/SKILL.md) for template engines (Jinja2, FreeMarker, Twig) — different attack surface [jndi injection](../jndi injection/SKILL.md) when EL evaluation leads to JNDI lookup Key distinction : SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes ( ${7 7} ) but diverge in exploitation. 1. DETECTION — POLYGLOT PROBES Disambiguation Response to ${7 7} Response to %{7 7} Engine 49 literal %{7 7} SpEL or Java EL literal ${7 7} 49 OGNL (Struts2) 49 49 Both may be active 2. SpEL (SPRING EXPRESSION LANGUAGE) Where SpEL Appears @Value("${...}") annotations Spring Security expressions ( @PreAuthorize ) Spring Cloud Gateway route predicates and filters Thymeleaf th:text="${...}" (when combined with ${...} preprocessing) Spring Data @Query with SpEL RCE via Runtime.exec RCE with Output Capture (Commons IO) RCE with Output Capture (Spring StreamUtils) ProcessBuilder (alternative when Runtime is blocked) Spring Cloud Gateway — CVE 2022 22947 Exploit via actuator to add malicious route with SpEL filter: SpEL Sandbox Bypass When SimpleEvaluationContext is used (restricts T() operator): 3. OGNL (OBJECT GRAPH NAVIGATION LANGUAGE) Where OGNL Appears Apache Struts2 — primary OGNL consumer Confluence Server — uses OGNL in certain request paths Any Java app using ognl.Ognl.getValue() or ognl.Ognl.setValue() Basic RCE Struts2 Sandbox Bypass — memberAccess Manipulation Struts2 restricts OGNL via SecurityMemberAccess . Classic bypass clears restrictions: Struts2 OgnlUtil Blacklist Clear Later Struts2 versions use class/package blacklists. Bypass by clearing excludedClasses and excludedPackageNames : Key Struts2 CVEs CVE Vector Payload Location S2 045 (CVE 2017 5638) Content Type header %{...} in Content Type S2 046 (CVE 2017 5638) Multipart filename OGNL in upload filename S2 016 (CVE 2013 2251) redirect: / redirectAction: prefix URL parameter S2 048 (CVE 2017 9791) Struts Showcase ActionMessage with OGNL S2 057 (CVE 2018 11776) Namespace OGNL URL path Confluence OGNL — CVE 2021 26084 Confluence Server allows OGNL injection via the queryString or action parameters: 4. JAVA EL (JSP / JSF) Where Java EL Appears JSP pages: ${expression} and {expression} JSF (JavaServer Faces): value and method bindings Custom tag libraries RCE Payloads 5. DETECTION METHODOLOGY 6. QUICK REFERENCE

expression-language-injection