CodeQL query for MVEL injections #72

CVE ID(s)

• CVE-2014-3120
• CVE-2013-6468

Report

I added a query that looks for expression language injections via MVEL, please see github/codeql#3329

MVEL is a powerful expression language that allows, in particular, calling arbitrary methods. That may lead to arbitrary code execution. In past, there were several issues (not reported by myself) due to unsafe evaluation of MVEL expressions:

• CVE-2014-3120: RCE in Elasticsearch, see also this blog post

• CVE-2013-6468: RCE in Drools

• Are you planning to discuss this vulnerability submission publicly? (Blog Post, social networks, etc). We would love to have you spread the word about the good work you are doing

I am planning to write a blog post about the query I wrote and catching MVEL injections with CodeQL.