- What is CWE-917?
- The product constructs all or part of an expression language (EL) statement in a framework such as a Java Server Page (JSP) using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended EL statement before it is executed.
- What CVEs are caused by CWE-917?
- 44 recorded CVEs are attributed to CWE-917, including CVE-2021-26084, CVE-2022-26134, CVE-2020-17530. 6 are listed in CISA's Known Exploited Vulnerabilities (KEV) catalog.
- How do you prevent CWE-917?
- Avoid adding user-controlled data into an expression interpreter when possible.
- How is CWE-917 detected?
- Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)
- What are the consequences of CWE-917?
- Exploiting CWE-917 can lead to: Read Application Data, Execute Unauthorized Code or Commands.
- Is CWE-917 actively exploited?
- Yes. 6 CWE-917 vulnerabilities are in CISA's KEV catalog of actively exploited flaws, out of 44 recorded CVEs.
