title: Expression Language Injection vulnerability struts 2.5.13
body: <p>I am using contrast security tool and seeing contrast reporting a vulnerability in my application saying expression language injection error.</p>
  
  <p>I have searched a lot on this, but did not find anything as my version almost latest.</p>
  
  <p>And Contrast is reporting request parameter named as "abc" is injected with something.</p>
  
  <p>Following is the error Contrast Report - Expression Language Injection from "abc" Parameter on "/App/edit.action"</p>
  
  <p>contrast Stack trace is showing something like this which states method in ognl jar - </p>
  
  <pre><code>ognl.Ognl.parseExpression(Ognl.java:110)
  com.opensymphony.xwork2.ognl.OgnlUtil.compileAndExecute(OgnlUtil.java:397)
  com.opensymphony.xwork2.ognl.OgnlUtil.setValue(OgnlUtil.java:310)
  com.opensymphony.xwork2.ognl.OgnlValueStack.trySetValue(OgnlValueStack.java:188)
  com.opensymphony.xwork2.ognl.OgnlValueStack.setValue(OgnlValueStack.java:175)
  com.opensymphony.xwork2.ognl.OgnlValueStack.setParameter(OgnlValueStack.java:157)
  com.opensymphony.xwork2.interceptor.ParametersInterceptor.setParameters(ParametersInterceptor.java:211)
  com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:129)
  com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.ParametersInterceptor.doIntercept(ParametersInterceptor.java:137)
  com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.StaticParametersInterceptor.intercept(StaticParametersInterceptor.java:201)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.MultiselectInterceptor.intercept(MultiselectInterceptor.java:67)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.DateTextFieldInterceptor.intercept(DateTextFieldInterceptor.java:133)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.CheckboxInterceptor.intercept(CheckboxInterceptor.java:89)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.FileUploadInterceptor.intercept(FileUploadInterceptor.java:243)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.ModelDrivenInterceptor.intercept(ModelDrivenInterceptor.java:101)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.ScopedModelDrivenInterceptor.intercept(ScopedModelDrivenInterceptor.java:142)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.ChainingInterceptor.intercept(ChainingInterceptor.java:160)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.PrepareInterceptor.doIntercept(PrepareInterceptor.java:175)
  com.opensymphony.xwork2.interceptor.MethodFilterInterceptor.intercept(MethodFilterInterceptor.java:99)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.I18nInterceptor.intercept(I18nInterceptor.java:121)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.interceptor.ServletConfigInterceptor.intercept(ServletConfigInterceptor.java:167)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.AliasInterceptor.intercept(AliasInterceptor.java:203)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.opensymphony.xwork2.interceptor.ExceptionMappingInterceptor.intercept(ExceptionMappingInterceptor.java:196)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  com.qd.bw.patient.common.web.DeviceDetectionInterceptor.intercept(DeviceDetectionInterceptor.java:68)
  com.opensymphony.xwork2.DefaultActionInvocation.invoke(DefaultActionInvocation.java:249)
  org.apache.struts2.factory.StrutsActionProxy.execute(StrutsActionProxy.java:48)
  org.apache.struts2.dispatcher.Dispatcher.serviceAction(Dispatcher.java:574)
  org.apache.struts2.dispatcher.ExecuteOperations.executeAction(ExecuteOperations.java:79)
  org.apache.struts2.dispatcher.filter.StrutsPrepareAndExecuteFilter.doFilter(StrutsPrepareAndExecuteFilter.java:141)
  weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
  org.owasp.stinger.StingerFilter.doStinger(StingerFilter.java:147)
  org.owasp.stinger.StingerFilter.doFilter(StingerFilter.java:93)
  weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
  org.owasp.csrfguard.CsrfGuardFilter.doFilter(CsrfGuardFilter.java:88)
  weblogic.servlet.internal.FilterChainImpl.doFilter(FilterChainImpl.java:78)
  weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.wrapRun(WebAppServletContext.java:3683)
  weblogic.servlet.internal.WebAppServletContext$ServletInvocationAction.run(WebAppServletContext.java:3649)
  weblogic.security.acl.internal.AuthenticatedSubject.doAs(AuthenticatedSubject.java:326)
  weblogic.security.service.SecurityManager.runAsForUserCode(SecurityManager.java:197)
  weblogic.servlet.provider.WlsSecurityProvider.runAsForUserCode(WlsSecurityProvider.java:203)
  weblogic.servlet.provider.WlsSubjectHandle.run(WlsSubjectHandle.java:71)
  weblogic.servlet.internal.WebAppServletContext.doSecuredExecute(WebAppServletContext.java:2433)
  weblogic.servlet.internal.WebAppServletContext.securedExecute(WebAppServletContext.java:2281)
  weblogic.servlet.internal.WebAppServletContext.execute(WebAppServletContext.java:2259)
  weblogic.servlet.internal.ServletRequestImpl.runInternal(ServletRequestImpl.java:1686)
  weblogic.servlet.internal.ServletRequestImpl.run(ServletRequestImpl.java:1646)
  weblogic.servlet.provider.ContainerSupportProviderImpl$WlsRequestExecutor.run(ContainerSupportProviderImpl.java:270)
  weblogic.invocation.ComponentInvocationContextManager._runAs(ComponentInvocationContextManager.java:348)
  weblogic.invocation.ComponentInvocationContextManager.runAs(ComponentInvocationContextManager.java:333)
  weblogic.work.LivePartitionUtility.doRunWorkUnderContext(LivePartitionUtility.java:54)
  weblogic.work.PartitionUtility.runWorkUnderContext(PartitionUtility.java:41)
  weblogic.work.SelfTuningWorkManagerImpl.runWorkUnderContext(SelfTuningWorkManagerImpl.java:640)`enter code here`
  weblogic.work.ExecuteThread.execute(ExecuteThread.java:406)
  weblogic.work.ExecuteThread.run(ExecuteThread.java:346)
  </code></pre>