Improper Neutralization of Special Elements used in an Expression Language Statement
CWE-917
The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
We track 62 vulnerabilities of this type. 100% are rated high or critical, and the average CVSS score is 8.9. 9 have been exploited in real attacks.
How this weakness is prevented
- Architecture and Design: Avoid adding user-controlled data into an expression interpreter when possible.
- Implementation: If user-controlled data must be added to an expression interpreter, one or more of the following should be performed: Validate that the user input will not evaluate as an expression Encode the user input in a way that ensures it is not evaluated as an expression
- System Configuration Operation: The framework or tooling might allow the developer to disable or deactivate the processing of EL expressions, such as setting the isELIgnored attribute for a JSP page to true.
Latest Improper Neutralization of Special Elements used in an Expression Language Statement vulnerabilities
- 9.8 Critical severity
Hitachi Tuning Manager: Improper Neutralization of Special Elements used in an Expression Language Statement
Expression Language Injection vulnerability in Hitachi Tuning Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Tuning Manager: before 8.8.7-00.
- 9.8 Critical severity
ViewPower Pro: Improper Neutralization of Special Elements used in an Expression Language Statement
Voltronic Power ViewPower Pro Expression Language Injection Remote Code Execution Vulnerability. This vulnerability allows remote attackers to execute arbitrary code on affected installations of Voltronic Power ViewPower Pro. Authentication is not required to
- 9.8 Critical severity
Hitachi Global Link Manager: Improper Neutralization of Special Elements used in an Expression Language Statement
Expression Language Injection vulnerability in Hitachi Global Link Manager on Windows allows Code Injection.This issue affects Hitachi Global Link Manager: before 8.8.7-03.
- 9.8 Critical severity
sofa-rpc: Improper Neutralization of Special Elements used in an Expression Language Statement
SOFARPC is a Java RPC framework. Versions prior to 5.11.0 are vulnerable to remote command execution. Through a carefully crafted payload, an attacker can achieve JNDI injection or system command execution. In the default configuration of the SOFARPC framework
- 9.8 Critical severity
Hitachi Replication Manager: Improper Neutralization of Special Elements used in an Expression Language Statement
Expression Language Injection vulnerability in Hitachi Replication Manager on Windows, Linux, Solaris allows Code Injection.This issue affects Hitachi Replication Manager: before 8.8.5-02.
- 8.8 High severity
Apache Ambari: Improper Neutralization of Special Elements used in an Expression Language Statement
SpringEL injection in the metrics source in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
- 8.8 High severity
Apache Ambari: Improper Neutralization of Special Elements used in an Expression Language Statement
SpringEL injection in the server agent in Apache Ambari version 2.7.0 to 2.7.6 allows a malicious authenticated user to execute arbitrary code remotely. Users are recommended to upgrade to 2.7.7.
- 8.8 High severity
Apache Jena: Improper Neutralization of Special Elements used in an Expression Language Statement
There is insufficient restrictions of called script functions in Apache Jena versions 4.8.0 and earlier. It allows a remote user to execute javascript via a SPARQL query. This issue affects Apache Jena: from 3.7.0 through 4.8.0.
- 9.8 Critical severity
Discover: Improper Neutralization of Special Elements used in an Expression Language Statement
Nepxion Discovery is a solution for Spring Cloud. Discover is vulnerable to SpEL Injection in discovery-commons. DiscoveryExpressionResolver’s eval method is evaluating expression with a StandardEvaluationContext, allowing the expression to reach and interact
- 9.8 Critical severity
Spring Data MongoDB: Improper Neutralization of Special Elements used in an Expression Language Statement
A Spring Data MongoDB application is vulnerable to SpEL Injection when using @Query or @Aggregation-annotated query methods with SpEL expressions that contain query parameter placeholders for value binding if the input is not sanitized.
- 9.8 Critical severity
Atlassian Confluence Server and Data Center Remote Code Execution Exploited
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are from 1.3.0 before
- 8.8 High severity
Irisnext: Improper Neutralization of Special Elements used in an Expression Language Statement
The BeanShell components of IRISNext through 9.8.28 allow execution of arbitrary commands on the target server by creating a custom search (or editing an existing/predefined search) of the documents. The search components permit adding BeanShell expressions th
- 7.2 High severity
geoserver: Improper Neutralization of Special Elements used in an Expression Language Statement
GeoServer is an open source software server written in Java that allows users to share and edit geospatial data. The GeoServer security mechanism can perform an unchecked JNDI lookup, which in turn can be used to perform class deserialization and result in arb
- 7.2 High severity
geotools: Improper Neutralization of Special Elements used in an Expression Language Statement
GeoTools is an open source Java library that provides tools for geospatial data. The GeoTools library has a number of data sources that can perform unchecked JNDI lookups, which in turn can be used to perform class deserialization and result in arbitrary code
- 9.8 Critical severity
VMware Tanzu Spring Cloud Function Remote Code Execution Exploited
In Spring Cloud Function versions 3.1.6, 3.2.2 and older unsupported versions, when using routing functionality it is possible for a user to provide a specially crafted SpEL as a routing-expression that may result in remote code execution and access to local r
- 10.0 Critical severity
VMware Spring Cloud Gateway Code Injection Exploited
In spring cloud gateway versions prior to 3.1.1+ and 3.0.7+ , applications are vulnerable to a code injection attack when the Gateway Actuator endpoint is enabled, exposed and unsecured. A remote attacker could make a maliciously crafted request that could all
- 9.0 Critical severity
Apache Log4j2 Deserialization of Untrusted Data Exploited
It was found that the fix to address CVE-2021-44228 in Apache Log4j 2.15.0 was incomplete in certain non-default configurations. This could allows attackers with control over Thread Context Map (MDC) input data when the logging configuration uses a non-default
- 10.0 Critical severity
Apache Log4j2 Remote Code Execution Exploited
Apache Log4j2 2.0-beta9 through 2.15.0 (excluding security releases 2.12.2, 2.12.3, and 2.3.1) JNDI features used in configuration, log messages, and parameters do not protect against attacker controlled LDAP and other JNDI related endpoints. An attacker who c
- 9.8 Critical severity
Atlassian Confluence Server and Data Center Object-Graph Navigation Language (OGNL) Injection Exploited
In affected versions of Confluence Server and Data Center, an OGNL injection vulnerability exists that would allow an unauthenticated attacker to execute arbitrary code on a Confluence Server or Data Center instance. The affected versions are before version 6.
- 9.8 Critical severity
Apache Struts Remote Code Execution Exploited
Forced OGNL evaluation, when evaluated on raw user input in tag attributes, may lead to remote code execution. Affected software : Apache Struts 2.0.0 - Struts 2.5.25.
- 8.8 High severity
Sonatype Nexus Repository Remote Code Execution Exploited
Sonatype Nexus Repository before 3.21.2 allows JavaEL Injection (issue 1 of 2).
- 8.8 High severity
Red Hat Linux JBoss Seam 2 Remote Code Execution Exploited
JBoss Seam 2 (jboss-seam2), as used in JBoss Enterprise Application Platform 4.3.0 for Red Hat Linux, does not properly sanitize inputs for JBoss Expression Language (EL) expressions, which allows remote attackers to execute arbitrary code via a crafted URL. N