expression-language-injection

An Expression Language (EL) injection attack playbook for authorized security testing, covering Spring Expression Language (SpEL), OGNL, and Java EL (JSP/JSF). It draws a clear line between EL injection, which targets expression evaluators embedded in Java frameworks, and server-side template injection, which targets template engines, noting that the two share detection probes but diverge in exploitation. Detection starts with polyglot arithmetic probes in the different EL syntaxes and a disambiguation table that maps responses to the underlying engine. The SpEL section describes where the language appears (value annotations, Spring Security expressions, Spring Cloud Gateway, Spring Data queries) and how command execution and output capture are achieved, including a reflection-based sandbox bypass when a restricted evaluation context is used, and the Spring Cloud Gateway actuator route-injection technique (CVE-2022-22947) with cleanup steps for stealth. The OGNL section focuses on Apache Struts2 and Confluence, covering the classic _memberAccess manipulation and blacklist-clearing bypasses and a table of key Struts2 CVEs (S2-045, S2-046, S2-016, S2-048, S2-057) plus Confluence's CVE-2021-26084. A final section addresses Java EL in JSP and JSF, including reflection-based payloads. The material is intended for penetration testers and security researchers operating under authorization.