MITRE’s description of CWE-917: The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
Common consequences MITRE lists
- Confidentiality: Read Application Data
- Integrity: Execute Unauthorized Code or Commands
Expression languages can call methods, reference types and create objects, so an injected expression runs code; NVD maps Log4Shell (CVE-2021-44228) and the Confluence OGNL flaw CVE-2022-26134 to this weakness.
- Never evaluate request data as an expression; map choices such as sort and filter fields to code through an allowlist.
- In Spring, evaluate only expressions the application wrote, with
SimpleEvaluationContext, neverStandardEvaluationContext. - Patch frameworks and products that evaluate expressions internally, such as Struts and Confluence.
Guides on this site
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Prevent NoSQL, LDAP, XPath and expression-language injection
SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Practice
- SQL injection lab: Separate SQL structure from data with sqlite3 · Browser lab
- OS command injection lab: Run git without a shell · Browser lab
- SSTI lab: Render a welcome banner without template injection · Browser lab
- XXE lab: Parse an uploaded invoice without resolving external entities · Browser lab
- Pickle deserialization lab: Load a session token without pickle · Browser lab
- Parse bounded JSON and XML invoices safely · Local project
- Repair a native parser using sanitizer evidence · Local project
References
List data from MITRE; the name, definition and consequences are from MITRE’s CWE 4.20 catalogue. A guide is listed as the main subject when the weakness is what the guide is about, and as covering it when a dedicated section or worked example addresses it.
CWE content: Copyright © 2006–2026, The MITRE Corporation. CWE, CWSS, CWRAF, and the CWE logo are trademarks of The MITRE Corporation. CWE™ is free to use by any organization or individual for any research, development, and/or commercial purposes, per these CWE Terms of Use. Accordingly, The MITRE Corporation hereby grants you a non-exclusive, royalty-free license to use CWE for research, development, and commercial purposes. Any copy you make for such purposes is authorized on the condition that you reproduce MITRE’s copyright designation and this license in any such copy. CWE is a trademark of The MITRE Corporation. CWE Terms of Use.