Falhas do tipo CWE-917

67 resultados

Injeção de Linguagem de Expressão

Ocorre quando uma aplicação permite que entrada do usuário seja interpretada como código em uma linguagem de expressão (EL, SpEL, OGNL, etc.) sem neutralização prévia. Um atacante injeta expressões maliciosas que são executadas no servidor, permitindo acesso a objetos da aplicação, execução de métodos arbitrários ou leitura de dados sensíveis.

Exemplo

Uma aplicação JSP que constrói uma mensagem de boas-vindas assim: `<h1>${param.nome}</h1>`. Se um atacante enviar `?nome=${Runtime.getRuntime().exec('rm -rf /')}`, a expressão será avaliada no servidor e o comando será executado.

Como mitigar

Nunca interprete entrada de usuário como código de expressão. Se for necessário usar EL, desative-a ou use apenas acesso a propriedades seguras (whitelist). Valide e escape todas as entradas; prefira templates que não avaliam expressões dinâmicas ou use sandboxing com acesso restrito a APIs perigosas.

CVE-2023-26092CRITICALLiima before 1.17.28 allows server-side template injection.EPSS 0.9%CVE-2026-40477CRITICALImproper restriction of the scope of accessible objects in Thymeleaf expressionsEPSS 0.9%CVE-2026-83531HIGHApache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control MessagesEPSS 0.9%CVE-2026-2586CRITICALAn authenticated Remote Code Execution (RCE) vulnerability was identified in GlassFish's Administration Console. A user with access to the pEPSS 0.8%CVE-2026-95664MEDIUMApache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsEPSS 0.8%CVE-2026-82912HIGHApache OFBiz: Unsandboxed Groovy compiled from a service parameterEPSS 0.7%CVE-2026-33938HIGHHandlebars.js has JavaScript Injection via AST Type Confusion by tampering @partial-blockEPSS 0.7%CVE-2026-65591HIGHn8n before 1.123.64 Sanitizer Bypass Remote Code ExecutionEPSS 0.7%CVE-2024-51466CRITICALIBM Cognos Analytics expression language injectionEPSS 0.7%CVE-2026-52439CRITICALAn issue in xiandafu beetl 3.20.2 allows a remote attacker to execute arbitrary code via the type.new function and the property reflection mEPSS 0.7%CVE-2025-3322CRITICALImproper Neutralization of Special Elements in OnlineSuiteEPSS 0.7%CVE-2026-33943HIGHHappy DOM ECMAScriptModuleCompiler: unsanitized export names are interpolated as executable codeEPSS 0.6%CVE-2026-2587CRITICALA critical Remote Code Execution (RCE) vulnerability was identified in the server-side template rendering mechanism used by the Glassfish gaEPSS 0.6%CVE-2026-34714CRITICALVim before 9.2.0272 allows code execution that happens immediately upon opening a crafted file in the default configuration, because %{expr}EPSS 0.6%CVE-2024-7552MEDIUMDataGear Data Schema Page ConversionSqlParamValueMapper.java evaluateVariableExpression expression language injectionEPSS 0.6%CVE-2026-24737HIGHjsPDF has a PDF Injection in AcroFormChoiceField which allows Arbitrary JavaScript ExecutionEPSS 0.6%CVE-2026-109432CRITICALCamunda Expression Injection via orQueries RCEEPSS 0.6%CVE-2026-22729HIGHCVE-2026-22729: JSONPath Injection in Spring AI Vector Stores FilterExpressionConverterEPSS 0.6%CVE-2026-40897HIGHMath.js: Unsafe object property setter in mathjsEPSS 0.6%CVE-2022-23504MEDIUMTYPO3 contains Sensitive Information Disclosure via YAML Placeholder Expressions in Site ConfigurationEPSS 0.5%