Uploaded image for project: 'XWork'
  1. XWork
  2. XW-146

Security issue due to parameter names being evaluated

    XMLWordPrintableJSON

Details

    • Bug
    • Status: Closed
    • Major
    • Resolution: Fixed
    • 1.0-beta2
    • 1.0
    • Interceptors
    • None

    Description

      The ParametersInterceptor evaluates all parameter names using OGNL. This allows an attacker to execute code such as

      @System@exit(1).dummy

      Attachments

        Activity

          People

            Unassigned Unassigned
            johnpatt John Patterson
            Votes:
            0 Vote for this issue
            Watchers:
            1 Start watching this issue

            Dates

              Created:
              Updated:
              Resolved: