expression-language-injection
Pass
Audited by Gen Agent Trust Hub on Sep 23, 2026
Risk Level: SAFEDATA_EXFILTRATIONCOMMAND_EXECUTIONREMOTE_CODE_EXECUTIONOBFUSCATIONDYNAMIC_EXECUTION
Full Analysis
- [DYNAMIC_EXECUTION]: The methodology provides extensive templates for achieving arbitrary code execution through Java reflection (e.g., getMethod, invoke), ScriptEngineManager (JavaScript evaluation), and the ProcessBuilder API to bypass execution restrictions.
- [DATA_EXFILTRATION]: The skill documents techniques for exfiltrating data to external domains using common utilities like curl and nslookup for HTTP and DNS-based out-of-band communication.
- [REMOTE_CODE_EXECUTION]: The files include specific exploit payloads for critical vulnerabilities, including Spring Cloud Gateway (CVE-2022-22947), Struts2 (S2-045, S2-057), and Confluence (CVE-2021-26084).
- [OBFUSCATION]: The skill details methods to evade security filters and Web Application Firewalls (WAFs) using character encoding (e.g., Character.toChars), Unicode escaping, and reflection-based keyword obfuscation to hide sensitive class and method names.
- [COMMAND_EXECUTION]: Instructions provide various ways to execute shell commands (e.g., id, whoami, cat) within different expression language contexts, including methods to handle operating system differences.
Audit Metadata