3 ms·
Remote Execution Flaws a Risk to Spring Framework Applications
- mthomas 14y agoThere is no information in that article except generic language about injection. I believe this is the actual advisory: http://www.mindedsecurity.com/fileshare/ExpressionLanguageInjection.pdf http://www.mindedsecurity.com/fileshare/ExpressionLanguageIn... It appears that spring double evaluates the expressions, so you can send a request param that is an EL expression that references values present in the server environment.