Fallos del tipo CWE-917

67 resultados

Injeção em Linguagem de Expressão

Fraqueza em que dados não validados do usuário são incorporados diretamente em expressões de linguagens como EL (Expression Language), permitindo que um atacante execute código arbitrário no servidor. O risco está em confiar que entradas externas são seguras para avaliar como código.

Ejemplo

Uma aplicação web Java/JSF que monta uma mensagem dinâmica assim: `${userInput}` sem sanitizar a entrada. Se o usuário injetar `${7*7}` ou pior, `${Runtime.getRuntime().exec('comando')}`, o servidor avalia e executa a expressão, comprometendo a segurança.

Cómo mitigar

Nunca avalie strings de entrada de usuário como expressões EL ou similares. Use templates com variáveis parametrizadas (não interpretadas), valide e escape toda entrada externa, e configure o motor de expressão para modo restritivo quando possível.

CVE-2022-4146HIGHEL Injection Vulnerability in Hitachi Replication ManagerEPSS 0.5%CVE-2026-41883HIGHOmniFaces: EL injection via crafted resource name in wildcard CDN mappingEPSS 0.5%CVE-2026-31380MEDIUMApache OFBiz: FreeMarker SSTI via Duplicate Parameter Sanitization BypassEPSS 0.5%CVE-2025-41253HIGHSpring Cloud Gateway Webflux SpEL Injection Vulnerability Allowing Exposure of Environment VariablesEPSS 0.5%CVE-2025-11175HIGHDiscussionTools should use better regexEPSS 0.5%CVE-2026-32695MEDIUMTraefik has Knative Ingress Rule Injection that Allows Host Restriction BypassEPSS 0.5%CVE-2024-12798MEDIUMJaninoEventEvaluator vulnerabilityEPSS 0.5%CVE-2024-0715HIGHEL Injection Vulnerability in Hitachi Global Link ManagerEPSS 0.5%CVE-2026-11561CRITICALSSTI in Soagen Informatics' ApinizerEPSS 0.4%CVE-2026-42811CRITICALApache Polaris: could broaden vended GCS credentials through unescaped identifier content in access-boundary CEL conditionsEPSS 0.4%CVE-2026-41901CRITICALThymeleaf: Improper recognition of unauthorized syntax patterns in sandboxed Thymeleaf expressionsEPSS 0.4%CVE-2026-44209HIGHBanks: Critical Remote Code Execution (RCE) via Jinja2 SSTIEPSS 0.4%CVE-2026-91145HIGHActiviti through 7.1.0.M6 Expression Injection via Mail TaskEPSS 0.4%CVE-2026-41729HIGHSpring Data REST SpEL Injection via Map Key in JSON PatchEPSS 0.4%CVE-2026-8759MEDIUMxiandafu beetl SpELFunction SpELFunction.java expression language injectionEPSS 0.4%CVE-2024-5828HIGHEL Injection Vulnerability in Hitachi Tuning ManagerEPSS 0.4%CVE-2024-4286MEDIUMImproper Neutralization of Special Elements in mintplex-labs/anything-llmEPSS 0.4%CVE-2026-41705HIGHSpring AI's MilvusVectorStore#doDelete(List) implementation is vulnerable to filter-expression injection via unsanitized document IDs. SprinEPSS 0.4%CVE-2026-108334HIGHGithub.com/kuadrant/kuadrant-operator/internal/wasm: github.com/rh-api-management/rhcl-operator-product-build/kuadrant-operator: kuadrant-operator: crafted httproute match values can bypass gateway policy overridesEPSS 0.3%CVE-2026-41717HIGHSpring Data MongoDB - SpEL Expression Injection via Annotated Query Parameter BindingEPSS 0.3%