Home / Knowledge hub / Expression language injection
Knowledge hub
Expression language injection
Input evaluated as an expression by a framework, which can run code.
What it means
Many Java and other frameworks let a page or a setting contain small expressions, such as a field name in curly braces that gets replaced by a value. Expression language injection happens when user input is passed to that evaluator, so the framework runs what the visitor typed.
The evaluator was built to be powerful. It can read objects, call methods and reach other parts of the application. Handing it untrusted text is much like handing someone a command line, even though the page looked like it was only showing a message.
Why it matters
The outcome ranges from reading values you never meant to expose, such as configuration and environment variables, to full remote code execution. Several well-known incidents in popular Java frameworks began with an expression evaluated from request data.
It can sit behind ordinary features: a validation message that echoes input, a search with a custom template, a redirect path. Because it lives in a framework and not in your business code, reviews often miss it, and a dependency update may be what fixes it.
How it shows up
You meet it in frameworks such as Spring, JSF and Struts, in template engines and in rules or workflow engines that accept an expression as a setting. Typical triggers are request parameters placed into error messages, view names, labels or filters, where the framework evaluates the text a second time.
Avoid passing user input into any evaluator. Where you must accept rules, use a restricted evaluator that cannot call arbitrary methods. Keep frameworks patched, since several flaws were framework bugs. Test by sending expression syntax in each field and watching for a computed result. It is closely related to template injection.
Questions people ask
Expression language injection, answered
Is it the same as template injection?
They are close cousins. Both involve input reaching an engine that evaluates it. Expression language injection usually names the expression syntax inside Java-style frameworks, while template injection covers the template engine around it.
Which technologies are affected?
Java frameworks that use expression languages are the best known, including Spring and JSF. Other stacks have their own versions. Any engine that evaluates text at runtime can be misused if input reaches it.
How can an attacker confirm it works?
Usually by sending a harmless expression that does arithmetic and seeing the computed result in the response. Seeing 49 where 7*7 was sent is the standard sign.
From there the severity depends on what the evaluator allows.
Does input validation fix it?
It helps, but it is not enough alone. Expression syntax is easy to disguise, so block lists fail. The strong fix is never to give user input to the evaluator, and to restrict what the evaluator can do.
How do we test for it?
Send harmless arithmetic expressions in every field, header and parameter, and compare the output. Reading the code for places where request data reaches an evaluator finds the cases that return nothing visible.
Related
Terms that sit next to this one
Server-side template injection
User input evaluated by your template engine, often leading to code execution.
Remote code execution
Getting a server to run commands of an attacker's choosing.
Injection
Input that ends up running as a command instead of being read as text.
Untrusted input
Anything that arrived from outside your own code, and is therefore suspect.
Dependency vulnerability
A known flaw in a library your application ships.
Does your framework run what it reads?
Expression evaluation is hard to see from outside, which is where reading the code helps. In white-box mode we follow input to the evaluator and prove the result against the running app. Book a pilot on one app.
Or start with a $199 pilot on one application: thirty days, success criteria agreed before day one, credited against the annual if you convert.