Activiti MailActivityBehavior EL Injection Bypass via #{} Syntax

Vulnerability Summary: EL Injection Guard Bypass (MailActivityBehavior) Overview Title: EL Injection Guard Bypass via Deferred Expression Syntax ( ) in MailActivityBehavior ID: #5438 Status: Open (created by on 2026-06-13) Core Issue: The EL injection guard in only matches and permits deferred expressions in format. Deferred expressions in format are evaluated at runtime by in the same manner, thereby bypassing the validation and entering execution within the full Spring EL context. Scope of Impact Affected Versions: / Affected Version Range: (Maven Central); (GitHub) CVSS 3.1: CWE: CWE-917 (Improper Neutralization of Special Characters in Expression Language Statement) Impact: Users with the role can store EL expressions as process variable values, bypassing security controls, which are then evaluated within the full Spring application context, allowing: - Invocation of any Spring Bean methods visible in the application context (e.g., , , , custom service Beans) - Reading internal state of the process engine, process definitions, and deployed task assignments - Invoking Spring service methods that are not registered for deferred evaluation - Direct OS command execution ( or ): While constrained by , Bean method invocations are not restricted; exploitability depends on which Spring Beans are registered in the deployed application Fix Extend the in to also match deferred expression syntax, treating it equivalently to (validate/intercept or allow, depending on the security policy) Alternatively, perform additional validation/escaping for expressions in of to prevent them from being passed directly into Add whitelist or sandbox restrictions on Bean method invocations in POC / Exploit Code (The page is marked "available upon request"; the complete POC is not directly displayed. The following are key code snippets cited on the page) 1. Validator Regular Expression (matches only ) 2. MailActivityBehavior Retrieving Expression 3. JUEL Handling of Deferred Expressions 4. Spring Context Resolver (Exposes All Beans)

Goal Reached Thanks to every supporter — we hit 100%!

Activiti MailActivityBehavior EL Injection Bypass via #{} Syntax

More from this source