Expression Language Injection
Variants:
Direct Persistent Session
Vector Type:
Attack
Relevance:
Technology Specific
Layer:
Application-Level
Platforms:
Spring Framework - Java
Target Type:
Web Application
Affected Mechanisms:
Input Validation, Syntax Escaping, Secure Design
Invented In:
12/09/2011
Added In:
31/12/2014
Vector Operation Method:
Malicious inputs can affect the server-side Spring EL interpreter to execute attacker controlled code in the context of the application. The vulnerability may exists in applications based on Java Spring Framework versions 3.0.0 - 3.0.5, and in Java Spring Applications that make use of programmatic EL syntax evaluation classes.
