Business Rules Evaluator

Payload Library

Benign — baseline

Arithmetic String concat Math.pow

CRITICAL-1 — EL Injection (Linux)

id — show current user whoami hostname uname -a env — dump env vars cat /etc/passwd

CRITICAL-1 — EL Injection (Windows)

whoami ipconfig

CRITICAL-1 — JVM introspection

Java version Working directory User home Class path

Notes

Expressions with checked exceptions (IOException, etc.) will fail javac — the generated eval() has no throws clause. Wrap in Runtime.getRuntime().exec() or use ProcessBuilder.

Use Show transpiled source to see the injected Java before it is compiled.

MVEL3 Expression Console