Lab 138 — PulseGuard — SpEL Injection via Whitelabel Error Page

hackadvisor

Task: Spring Boot 2.4.1 monitoring platform with WAF and Whitelabel Error Page that evaluates SpEL expressions in NumberFormatException messages. Solution: SpEL injection via type reference with space bypass (T ( instead of T(), string construction via Character.toString() to avoid literals, and reflection-based Scanner+File for arbitrary file read.