The vulnerability chain involves three key components:

1. StreamedContentHandler processes untrusted 'pfdrid' parameter, decrypts it using StringEncrypter, and evaluates the content as EL
2. StringEncrypter uses cryptographically weak algorithms (DES + static salt) with default password
3. ConfigContainer enforces the weak default password when not overridden Runtime detection would observe the StringEncrypter.decrypt() processing attacker-controlled ciphertexts, followed by EL evaluation in StreamedContentHandler. The ConfigContainer initialization shows the weak default being set when no configuration exists.