1183
Nature Type ID Name Page
ChildOf 668 Exposure of Resource to Wrong Sphere 1469
ParentOf 500 Public Static Field Not Marked Final 1200
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : C++ (Prevalence = Undetermined)
Background Details
Mobile code, such as a Java Applet, is code that is transmitted across a network and executed on
a remote machine. Because mobile code developers have little if any control of the environment
in which their code will execute, special security concerns become relevant. One of the biggest
environmental threats results from the risk that the mobile code will run side-by-side with other,
potentially malicious, mobile code. Because all of the popular web browsers execute code from
multiple sources together in the same JVM, many of the security guidelines for mobile code are
focused on preventing manipulation of your objects' state and behavior by adversaries who have
access to the same virtual machine where your program is running.
Final provides security by only allowing non-mutable objects to be changed after being set.
However, only objects which are not extended can be made final.
Likelihood Of Exploit
High
Common Consequences
Scope Impact Likelihood
Integrity Modify Application Data
The object could potentially be tampered with.
Confidentiality Read Application Data
The object could potentially allow the object to be read.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Implementation
Declare all public fields as final when possible, especially if it is used to maintain internal state of
an Applet or of classes used by an Applet. If a field must be public, then perform all appropriate
sanity checks before accessing the field from your code.
Demonstrative Examples
Example 1:
Suppose this WidgetData class is used for an e-commerce web site. The programmer attempts to
prevent price-tampering attacks by setting the price of the widget using the constructor.
CWE Version 4.14
CWE-493: Critical Public Variable Without Final Modifier
CWE-493: Critical Public Variable Without Final Modifier