Expression_Language_Injection_OGNL @ OGNLExpressionInjectionController.java

[AaronZhouYu]

Expression_Language_Injection_OGNL issue exists @ OGNLExpressionInjectionController.java in branch main

The user input provided in expression in expression at line 26 is inserted into a string, which is evaluated as an expression language statment by getValue in /src/main/java/org/t246osslab/easybuggy4sb/vulnerabilities/OGNLExpressionInjectionController.java at line 40 without being sanitized, resulting in execution of expression language code from a potentially untrusted source.

This may result in execution of an OGNL expression.

Namespace: AaronZhouYu
Repository: TotallySecureApp
Repository Url: https://github.com/AaronZhouYu/TotallySecureApp
CxAST-Project: AaronZhouYu/TotallySecureApp
CxAST platform scan: 044c3806-8e67-4c10-99a5-5e39d680a811
Branch: main
Application: TotallySecureApp
Severity: HIGH
State: TO_VERIFY
Status: RECURRENT
CWE: 917
Lines: 26

---

References
Read more