Agent skill · security · yaklang
expression-language-injection
Expression Language injection playbook. Use when Java EL, SpEL, OGNL, or MVEL expressions may evaluate attacker-controlled input in Spring, Struts2, Confluence, or similar frameworks.
Why this skill is useful
Provides detailed exploitation techniques and scripts for EL injection vulnerabilities that are not widely documented.
What it needs
About 3k tokens when loaded. Last updated 2026-06-16. 1,563 stars on the source repository.
What this skill does
SKILL: Expression Language Injection — Expert Attack Playbook AI LOAD INSTRUCTION: Expert EL injection techniques covering SpEL (Spring), OGNL (Struts2), and Java EL (JSP/JSF). Distinct from SSTI — EL injection targets expression evaluators in Java frameworks, not template engines. Covers sandbox bypass, memberAccess manipulation, actuator abuse, and real-world CVE chains. 0. RELATED ROUTING ssti-server-side-template-injection for template engines (Jinja2, FreeMarker, Twig) — different attack surface jndi-injection when EL evaluation leads to JNDI lookup Key distinction: SSTI targets template rendering engines; EL injection targets expression evaluators embedded in Java frameworks. They share detection probes (${77}) but diverge in exploitation. --- 1. DETECTION — POLYGLOT PROBES Disambiguation Response to ${77} Response to %{77} Engine --- --- --- 49 literal %{77} SpEL or Java EL literal ${77} 49 OGNL (Struts2) 49 49 Both may be active --- 2. SpEL (SPRING EXPRESSION LANGUAGE) Where SpEL Appears @Value("${...}") annotations Spring Security expressions (@PreAuthorize) Spring Cloud Gateway route predicates and filters Thymeleaf th:text="${...}" (when combined with ${...} preprocessing) Spring Data @Query with SpEL RCE via Runtime.exec RCE with Output Capture (Commons IO) RCE with Output Capture (Spring StreamUtils) ProcessBuilder (alternative when Runtime is blocked) Spring Cloud Gateway — CVE-2022-22947 Exploit via actuator to add malicious route with SpEL filter: SpEL Sandbox Bypass When SimpleEvaluationContext is used (restricts T() operator): --- 3. OGNL (OBJECT-GRAPH NAVIGATION LANGUAGE) Where OGNL Appears Apache Struts2 — primary OGNL consumer Confluence Server — uses OGNL in certain request paths Any Java app using ognl.Ognl.getValue() or ognl.Ognl.setValue() Basic RCE Struts2 Sandbox Bypass — memberAccess Manipulation Struts2 restricts OGNL via SecurityMemberAccess. …
How to use it
Reference it in AdaL, Claude Code, Cursor or any coding agent — nothing to install:
@skills yaklang/expression-language-injection