OGNL Expression Injection: Double Evaluation

Double OGNL evaluation allows attackers to evaluate arbitrary OGNL expressions when controlling the output of the first evaluation.

The application uses a forced OGNL expression (%{expr}) in a Struts tag that evaluates the OGNL expression twice. An attacker in control of the result of the first evaluation may be able to control the expression to be evaluated in the second OGNL evaluation and inject arbitrary OGNL expressions.

Example 1: The redirectAction result is known to evaluate its parameters twice. In this case the result of the forced OGNL expression in the actionName parameter may be controlled by an attacker by supplying a redirect request parameter.

    ...
    <action name="index" class="com.acme.MyAction">
        <result type="redirectAction">
            <param name="actionName">${#parameters['redirect']}</param>
            <param name="namespace">/foo</param>
        </result>
    </action>
    ...

Struts 2 code will internally evaluate the %{#parameters['redirect']} expression returning a user-controlled string that will be evaluated as an OGNL expression, allowing the attacker to evaluate arbitrary OGNL expressions.