CVE-2025-3322: Expression Language RCE Vulnerability

CVE-2025-3322 Overview

CVE-2025-3322 is an Expression Language Injection vulnerability that enables remote code execution with the highest privileges on affected servers. The vulnerability stems from improper neutralization of inputs used in expression language processing, classified under CWE-917 (Improper Neutralization of Special Elements used in an Expression Language Statement).

This vulnerability allows unauthenticated remote attackers to inject malicious expression language statements that are evaluated by the server, resulting in arbitrary code execution with elevated privileges. The attack requires no user interaction and can be executed over the network with low complexity.

Critical Impact

Successful exploitation grants attackers complete control over the target server with the highest privileges, enabling data theft, system compromise, lateral movement, and potential disruption of critical healthcare infrastructure.

Affected Products

• B. Braun medical device software (refer to B. Braun Product Security Page for specific affected versions)

Discovery Timeline

• June 6, 2025 - CVE-2025-3322 published to NVD
• June 6, 2025 - Last updated in NVD database

Technical Details for CVE-2025-3322

Vulnerability Analysis

The vulnerability exists in the expression language processing component, where user-controlled input is directly incorporated into expression language statements without proper sanitization or validation. Expression Language (EL) is commonly used in web application frameworks to dynamically evaluate expressions at runtime.

When an application fails to properly neutralize special characters and syntax elements in user input before incorporating it into EL statements, attackers can inject arbitrary expressions. These malicious expressions are then evaluated by the EL engine with the same privileges as the application, often resulting in remote code execution.

The vulnerability requires no authentication and no user interaction, making it particularly dangerous for internet-facing systems. The impact extends beyond the vulnerable component itself, potentially affecting other systems and data within the same security scope.

Root Cause

The root cause is improper input validation and neutralization of user-controlled data before it is processed by the expression language interpreter. The application fails to:

1. Sanitize special characters and syntax elements used in expression language
2. Implement proper input validation to reject malicious payloads
3. Apply principle of least privilege to expression language execution contexts
4. Use parameterized or pre-compiled expressions instead of dynamic string concatenation

Attack Vector

The attack is network-based and can be executed remotely without authentication. An attacker crafts a malicious HTTP request containing expression language injection payloads targeting vulnerable input parameters. When the server processes these inputs:

1. The malicious EL syntax is incorporated into an expression statement
2. The expression language engine evaluates the attacker-controlled expression
3. The injected code executes with the server's highest privileges
4. The attacker gains complete control over the target system

Common injection points include HTTP parameters, headers, cookies, and form fields that are processed by expression language engines. Attackers may leverage runtime class access to execute operating system commands, read sensitive files, or establish reverse shells.

Detection Methods for CVE-2025-3322

Indicators of Compromise

• Unusual HTTP requests containing expression language syntax such as ${, #{, or %{ patterns in unexpected parameters
• Server logs showing attempts to access runtime classes or process execution methods
• Unexpected outbound network connections from the affected server
• New processes spawned by the web application service
• Unauthorized file system modifications or new files in web-accessible directories

Detection Strategies

• Deploy web application firewall (WAF) rules to detect and block expression language injection patterns
• Monitor HTTP request logs for suspicious payloads containing EL syntax in form fields, headers, and URL parameters
• Implement application-level logging to track expression language evaluation events
• Configure intrusion detection systems (IDS) with signatures for known EL injection attack patterns
• Enable deep packet inspection for inbound traffic to web applications

Monitoring Recommendations

• Establish baseline behavior for application processes and alert on anomalies
• Monitor for child processes spawned by web server or application server processes
• Track outbound connections from application servers to detect potential reverse shells
• Review authentication and access logs for signs of privilege escalation
• Implement file integrity monitoring on critical system and application directories

How to Mitigate CVE-2025-3322

Immediate Actions Required

• Consult the B. Braun Product Security Page for vendor-specific patches and updates
• Restrict network access to affected systems using firewall rules until patches can be applied
• Implement web application firewall rules to block expression language injection attempts
• Review and audit all user input handling in affected applications
• Enable enhanced logging and monitoring on potentially affected systems

Patch Information

Vendor-specific patch information is available from B. Braun. Organizations should consult the B. Braun Product Security Page for official security advisories, affected product versions, and remediation guidance. Given the critical nature of this vulnerability and its potential impact on healthcare infrastructure, immediate patching is strongly recommended.

Workarounds

• Implement strict input validation to reject any input containing expression language syntax characters
• Deploy network segmentation to isolate affected medical devices from general network traffic
• Configure web application firewalls to block requests containing ${, #{, %{, and similar EL patterns
• Disable or restrict expression language features if not required for application functionality
• Implement network-level access controls to limit exposure of vulnerable systems to trusted networks only