Expression Language Injection
Severity: High
Summary #
Invicti identified a possible expression language injection, which occurs when input data is evaluated by an expression language interpreter.
Even though Invicti believes there is an expression language injection in here, it could not confirm it. There can be numerous reasons for Invicti not being able to confirm it. We strongly recommend investigating the issue manually to ensure it is an expression language injection and needs to be addressed.
Impact #
An attacker can read server-side data, such as the content of server-side variables, and some other inner configuration details. This is a quite dangerous vulnerability because developers assume their server-side code would not be read by anyone outside, so they may place sensitive information such as passwords, connection strings, database queries, etc. It can also be used for bypassing HttpOnly protection.
Remediation #
Apply input validation best practices to ensure there are no EL meta characters("${" and "#{") in the input.
Classifications #
PCI v3.1-6.5.1; PCI v3.2-6.5.1; CWE-20; HIPAA-164.308(a); ISO27001-A.14.2.5; OWASP 2013-A1; OWASP 2017-A1
, CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Vulnerability Index
You can search and find all vulnerabilities
Select Category
OR
Search Vulnerability
Related Vulnerabilities
