OGNL Injection: Java RCE Vulnerability Guide

Most developers never think about OGNL Injection…
But attackers actively look for it - because it can lead to Remote Code Execution (RCE) 💀
If you’re into bug bounty hunting or web security testing, understanding this vulnerability can seriously boost your success rate.
Let’s break it down in a simple, practical way 👇

What Is OGNL Injection?​

OGNL (Object-Graph Navigation Language) is used in some Java frameworks (like Apache Struts) to evaluate expressions at runtime.
👉 The problem happens when:

• User input is directly passed into OGNL expressions
• The application evaluates it without proper validation

This allows attackers to execute arbitrary code on the server.

---

How OGNL Injection Works (Simple Example)​

Normal request:​

/login?name=admin

Testing payload:​

/login?name=%{7*7}

If the response returns:​

49
🚨 That means the server is evaluating your input → Vulnerable to OGNL Injection

---

Confirming the Vulnerability (Advanced Payload)​

You can go further to confirm exploitation:

%{#context['com.opensymphony.xwork2.dispatcher.HttpServletResponse']
.addHeader('X-Vulnerable','Yes')}

👉 If the response includes the header:

X-Vulnerable: Yes

💀 Vulnerability confirmed.

---

Real Impact of OGNL Injection​

This is not a low-risk bug.
If exploited, an attacker can:

• ✅ Execute system commands
• ✅ Upload a web shell
• ✅ Access sensitive data
• ✅ Bypass authentication
• ✅ Take full control of the server

👉 This is why OGNL Injection often leads to critical severity reports

---

Bug Bounty Testing Payloads 🎯​

When testing for OGNL Injection, try:

%{7*7}
${7*7}
%{#a=1+1}
%{#context}
%{#_memberAccess}

Pro Tip 💡​

Don’t just test URL parameters - inject payloads into:

• Headers
• Cookies
• JSON body
• File uploads
• Hidden parameters

👉 Many real-world bugs are found outside obvious inputs

---

Real-World Example (Why This Matters)​

A famous OGNL Injection vulnerability in Apache Struts led to one of the largest data breaches in history.
👉 Millions of user records were exposed due to a single unpatched vulnerability.
This proves one thing: Never underestimate OGNL Injection.

---

How to Prevent OGNL Injection 🛡️​

If you’re a developer, here’s how to stay safe:

✔️ Disable dynamic OGNL expression evaluation
✔️ Never evaluate user-controlled input
✔️ Validate and sanitize all inputs
✔️ Keep frameworks updated
✔️ Use security filters and WAF protection
✔️ Apply the principle of least privilege​

---

Hacker Mindset: Where to Look 🔍​

If you’re testing applications:

• Focus on Java-based apps (especially older frameworks)
• Look for dynamic expression handling
• Test everywhere input is reflected

👉 The key is to think like the application engine

---

Final Thoughts​

OGNL Injection is one of those vulnerabilities that many overlook…
But for attackers, it’s a goldmine.
One payload… one mistake… 👉 Full server compromise.
Stay curious. Keep testing. Stay sharp 💻⚡