Lately, we came across a remote code execution in a Tomcat web service by
utilizing
Expression Language.
The vulnerable POST body field expected a number. When sending ${1+2} instead,
the web site included a Java error message about a failed conversion to
java.lang.Long from java.lang.String with value "3".
From that error message we learned a couple of things:
- The application uses Java
- We are able to execute EL expressions
- Output from the EL engine is always returned as
String
Whenever you are able to execute code within a Java Context, the most
interesting part is to check whether we can get a Runtime object and execute
arbitrary OS commands.