CWE-917 (表达式语言语句中使用的特殊元素转义处理不恰当(表达式语言注入)) — Vulnerability Class 26

CWE-917 represents a critical input validation weakness where software constructs expression language statements, such as those in Java Server Pages, using untrusted external input without proper sanitization. Attackers typically exploit this vulnerability by injecting malicious code snippets into user-controlled fields, allowing them to manipulate the intended logic of the expression language. This injection can lead to severe consequences, including remote code execution, data theft, or unauthorized system access, as the application executes the attacker’s modified commands instead of the original developer intent. To prevent this, developers must strictly validate and neutralize all special elements within expression language statements before execution. Implementing allow-lists for acceptable inputs, utilizing parameterized expressions where possible, and employing robust input filtering mechanisms are essential strategies to ensure that external data cannot alter the structural integrity of the expression language, thereby mitigating the risk of injection attacks.