A vulnerability in Apache Commons OGNL allows for improper neutralization of expression/command delimiters. This issue affects all versions of Apache Commons OGNL. Although there are attempts to restrict dangerous classes and methods, attackers may bypass these restrictions, potentially leading to arbitrary code execution. As the project is retired, no fix will be released, and users are advised to seek alternatives or limit access.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.8 | CVE-2025-53192 |
Exploitation
To exploit this vulnerability, an attacker can craft a malicious expression that bypasses the blocklist restrictions in the OGNL engine. By leveraging class objects not covered by the blocklist, the attacker may execute arbitrary code on the server where the vulnerable instance is running.
Affected Products
- Apache Commons OGNL: All versions are affected by this vulnerability, as it allows for arbitrary code execution through improper handling of expressions.
Mitigation
Due to the retirement of the Apache Commons OGNL project, no official fix will be provided. Users are strongly encouraged to migrate to alternative solutions or restrict access to the OGNL instance to trusted users only.