Page History

...

OGNL provides, among other features, extensive expression evaluation capabilities. The vulnerability allows a malicious user to bypass all the protections (regex pattern, deny method invocation) built into the ParametersInterceptor, thus being able to inject a malicious expression in any exposed string variable for further evaluation.

A similar behavior was already addressed in [S2-003] and [S2-005], but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially.

 
According to the regex pattern present into the ParametersInterceptor top\['foo'\](0) is a valid expression, unfortunately expression like this are further evaluated, hence resolved, by the OGNL parser. Then, a malicious user could inject into the foo var one of the following reserved keyword, bypassing the beforementioned filter: 

• #context - OgnlContext, the one guarding method execution based on 'xwork.MethodAccessor.denyMethodExecution' property value.
• #_memberAccess - SecurityMemberAccess, whose 'allowStaticAccess' field prevented static method execution.
• #root
• #this
• #_typeResolver
• #_classResolver
• #_traceEvaluations
• #_lastEvaluation
• #_keepLastEvaluation

...