Expression language injection
Untrusted input becomes part of an expression in a language such as Spring Expression Language (SpEL), OGNL or Jakarta Expression Language, which can call methods and create objects, so the attacker runs code (CWE-917). Never evaluate request data as an expression; map it to fixed operations.
- Also called
- EL injection
- Defined in
- MITRE CWE-917
- Identifiers
- CWE-917: Expression language injection
Covered in
Keep untrusted input out of eval, expression languages and templates
Keep code and templates constant, pass input as data, and treat in-process sandboxes as one layer, not a boundary.
Prevent NoSQL, LDAP, XPath and expression-language injection
SQL is not the only query language that receives user input. Stop MongoDB operator injection with type checks and $eq, escape LDAP filter values, pass XPath values as variables, and never evaluate SpEL or OGNL built from request data.
Keep untrusted values out of executable syntax
Choose a safe interface for each interpreter and bound the work performed by parsers and converters.
Case study: Log4Shell (CVE-2021-44228)
How a JNDI lookup in Apache Log4j became internet-wide remote code execution, why transitive and shaded dependencies made it so hard to patch, which mitigations held, and what it teaches about dependency inventory and SBOMs.
Practice: SQL injection lab: Separate SQL structure from data with sqlite3 · OS command injection lab: Run git without a shell · SSTI lab: Render a welcome banner without template injection · XXE lab: Parse an uploaded invoice without resolving external entities