Expression Language Injection

Summary

Netsparker identified an expression language injection, which occurs when input data is evaluated by an expression language interpreter.

This is an important issue and should be addressed as soon as possible.

Impact

An attacker can read server-side data, such as the content of server-side variables, and some other inner configuration details. This is a quite dangerous vulnerability because developers assume their server-side code would not be read by anyone outside, so they may place sensitive information such as passwords, connection strings, database queries, etc. It can also be used for bypassing HttpOnly protection.

Remediation

Apply input validation best practices to ensure there are no EL meta characters("${" and "#{") in the input.

Classifications

PCI v3.1-6.5.1, PCI v3.2-6.5.1, OWASP 2013-A1 , CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Netsparker Security Insights

Helpful Use Cases

Vulnerability Index

You can search and find all vulnerabilities

Select Category

Search Vulnerability