The linked proof-of-concept [1] demonstrates bypassing the OGNL blacklist by using this to do reflection: > ""["class"].forName(...) as opposed to: > "".getC

The linked proof-of-concept [1] demonstrates bypassing the OGNL blacklist by using this to do reflection: > ""["class"].forName(...) as opposed to: > "".getClass().forName(...) Does anyone know why this works in OGNL? It does not appear to be valid Java syntax. [1] https://github.com/httpvoid/writeups/blob/main/Confluence-RCE.md https://github.com/httpvoid/writeups/blob/main/Confluence-RC... Edit: Oh apparently, it's just a feature of OGNL: https://commons.apache.org/proper/commons-ognl/language-guide.html https://commons.apache.org/proper/commons-ognl/language-guid...