Page History

A similar behavior was already addressed in [S2-003] and [S2-005], but it turned out that the resulting fix based on whitelisting acceptable parameter names closed the vulnerability only partially. 
AccordingRegular toexpression thein regexParametersInterceptor pattern present into the ParametersInterceptor matches top\['foo'\](0) isas a valid expression, unfortunately expression like this are further evaluated, hence resolved, by the OGNL parser. Then a malicious user can which OGNL treats as (top['foo'])(0) and evaluates the value of 'foo' action parameter as an OGNL expression. This lets malicious users put arbitrary OGNL statements into any String variable exposed by an action and have it evaluated as an OGNL expression and since OGNL statement is in HTTP parameter value attacker can use forbiddenblacklisted characters (e.g. #) to disable method execution and execute arbitrary methods, bypassing the aforementioned filterParametersInterceptor and injectingOGNL one of the following reserved keyword: 

library protections.