Page History

A similar behavior was already addressed in [S2-003] and [S2-005], but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially. 
According to the regex pattern present into the ParametersInterceptor top\['foo'\](0) is a valid expression, unfortunately expression like this are further evaluated, hence resolved, by the OGNL parser. Then, a malicious user could inject into the foo var one of the following reserved keyword can put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated and since OGNL statement is in HTTP parameter value attacker can use forbidden characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the beforementionedaforementioned filter and injecting one of the following reserved keyword: