Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
Miggo AIRoot Cause AnalysisThe vulnerability description and the provided reference clearly indicate that ActivitiTest.java in AntFlow V2.0.0 is responsible for enabling command execution through unfiltered JUEL expressions. The specific endpoint /admin-api/activiti/evalExpression and the 'el' parameter are explicitly mentioned as the vector for this vulnerability. The evalExpression method is the entry point that processes this malicious input without proper security checks, directly leading to the exploitation of the JUEL expression evaluation mechanism. While JuelEvaluator.java performs the actual evaluation, the root cause of the vulnerability lies in ActivitiTest.java's failure to validate user input before passing it to the evaluator. Therefore, com.antflow.admin.api.activiti.ActivitiTest.evalExpression is identified as the primary vulnerable function.
com.antflow.admin.api.activiti.ActivitiTest.evalExpressionActivitiTest.java