domains / families / security / expression-language-injection

expression-language-injection

separate

Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.

When to use

• Java EL injection
• SpEL injection
• OGNL injection
• MVEL injection
• Spring framework EL exploitation
• Struts2 OGNL exploitation
• Confluence OGNL exploitation
• EL sandbox bypass

When not to use

• Server-side template injection (SSTI)
• Template engine attacks (Jinja2, FreeMarker, Twig)
• JNDI injection

Skill page

Source