1170
Common Consequences
Scope Impact Likelihood
Confidentiality Read Application Data
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Protect the application's sessions from information leakage. Make sure that a session's data is
not used or visible by other sessions.
Phase: Testing
Use a static analysis tool to scan the code for information leakage vulnerabilities (e.g. Singleton
Member Field).
Phase: Architecture and Design
In a multithreading environment, storing user data in Servlet member fields introduces a data
access race condition. Do not use member fields to store information in the Servlet.
Demonstrative Examples
Example 1:
The following Servlet stores the value of a request parameter in a member field and then later
echoes the parameter value to the response output stream.
Example Language: Java (Bad)
public class GuestBook extends HttpServlet {
String name;
protected void doPost (HttpServletRequest req, HttpServletResponse res) {
name = req.getParameter("name");
...
out.println(name + ", thanks for visiting!");
}
}
While this code will work perfectly in a single-user environment, if two users access the Servlet at
approximately the same time, it is possible for the two request handler threads to interleave in the
following way: Thread 1: assign "Dick" to name Thread 2: assign "Jane" to name Thread 1: print
"Jane, thanks for visiting!" Thread 2: print "Jane, thanks for visiting!" Thereby showing the first user
the second user's name.
MemberOf Relationships
This MemberOf relationships table shows additional CWE Catgeories and Views that reference this
weakness as a member. This information is often useful in understanding where a weakness fits
within the context of external information sources.
Nature Type ID Name Page
MemberOf 485 7PK - Encapsulation 700 2328
CWE Version 4.14
CWE-489: Active Debug Code
CWE-489: Active Debug Code