Expression Payloads Meet Mayhem - Ivanti EPMM Unauth RCE Chain (CVE-2025-4427 and CVE-2025-4428)

implements ConstraintValidator<ValidDeviceFeatureUsageReportQueryRequest, DeviceFeatureUsageReportQueryRequest> { @Autowired private LocalizedMessageBuilder localizedMessageBuilder; public void initialize(ValidDeviceFeatureUsageReportQueryRequest constraintAnnotation) {} public boolean isValid(DeviceFeatureUsageReportQueryRequest value, ConstraintValidatorContext context) { String format = value.getFormat(); // [1] if (format == null) { return true; } boolean isValid = (format.equalsIgnoreCase("json") || format.equalsIgnoreCase("csv")); // [2] if (!isValid) { String formatMessage = this.localizedMessageBuilder.getLocalizedMessage((MessageCode)MessageKeys.DEVICE_FEATURE_USAGE_INVALID_FORMAT, new Object[] { format }); // [3] context.disableDefaultConstraintViolation();…