145
Relevant to the view "Software Development" (CWE-699)
Nature Type ID Name Page
MemberOf 137 Data Neutralization Issues 2311
Weakness Ordinalities
Primary :
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Alternate Terms
EL Injection :
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Integrity Execute Unauthorized Code or Commands
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Avoid adding user-controlled data into an expression interpreter when possible.
Phase: Implementation
If user-controlled data must be added to an expression interpreter, one or more of the following
should be performed: Validate that the user input will not evaluate as an expression Encode the
user input in a way that ensures it is not evaluated as an expression
Phase: System Configuration
Phase: Operation
The framework or tooling might allow the developer to disable or deactivate the processing of EL
expressions, such as setting the isELIgnored attribute for a JSP page to "true".
Observed Examples
Reference Description
CVE-2021-44228 Product does not neutralize ${xyz} style expressions, allowing remote code
execution. (log4shell vulnerability in log4j)
https://www.cve.org/CVERecord?id=CVE-2021-44228
MemberOf Relationships
CWE Version 4.14
CWE-918: Server-Side Request Forgery (SSRF)
CWE-918: Server-Side Request Forgery (SSRF)