1119
Nature Type ID Name Page
ChildOf 20 Improper Input Validation 20
Applicable Platforms
Language : Java (Prevalence = Undetermined)
Language : PHP (Prevalence = Undetermined)
Language : Interpreted (Prevalence = Sometimes)
Alternate Terms
Reflection Injection :
Common Consequences
Scope Impact Likelihood
Integrity
Confidentiality
Availability
Other
Execute Unauthorized Code or Commands
Alter Execution Logic
The attacker might be able to execute code that is not
directly accessible to the attacker. Alternately, the attacker
could call unexpected code in the wrong place or the
wrong time, possibly modifying critical system state.
Availability
Other
DoS: Crash, Exit, or Restart
Other
The attacker might be able to use reflection to call the
wrong code, possibly with unexpected arguments that
violate the API (CWE-227). This could cause the product to
exit or hang.
Confidentiality Read Application Data
By causing the wrong code to be invoked, the attacker
might be able to trigger a runtime error that leaks sensitive
information in the error message, such as CWE-536.
Detection Methods
Automated Static Analysis
Automated static analysis, commonly referred to as Static Application Security Testing (SAST),
can find some instances of this weakness by analyzing source code (or binary/compiled code)
without having to execute it. Typically, this is done by building a model of data flow and control
flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input)
with "sinks" (destinations where the data interacts with external components, a lower layer such
as the OS, etc.)
Effectiveness = High
Potential Mitigations
Phase: Architecture and Design
Refactor your code to avoid using reflection.
Phase: Architecture and Design
Do not use user-controlled inputs to select and load classes or code.
Phase: Implementation
Apply strict input validation by using allowlists or indirect selection to ensure that the user is only
selecting allowable classes or code.
Demonstrative Examples
Example 1:
CWE Version 4.14
CWE-470: Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection')
CWE-470: Use of Externally-Controlled Input
to Select Classes or Code ('Unsafe Reflection') 1120
A common reason that programmers use the reflection API is to implement their own command
dispatcher. The following example shows a command dispatcher that does not use reflection:
Example Language: Java (Good)
String ctl = request.getParameter("ctl");
Worker ao = null;
if (ctl.equals("Add")) {
ao = new AddCommand();
}
else if (ctl.equals("Modify")) {
ao = new ModifyCommand();
}
else {
throw new UnknownActionError();
}
ao.doAction(request);
A programmer might refactor this code to use reflection as follows:
Example Language: Java (Bad)
String ctl = request.getParameter("ctl");
Class cmdClass = Class.forName(ctl + "Command");
Worker ao = (Worker) cmdClass.newInstance();
ao.doAction(request);
The refactoring initially appears to offer a number of advantages. There are fewer lines of code,
the if/else blocks have been entirely eliminated, and it is now possible to add new command
types without modifying the command dispatcher. However, the refactoring allows an attacker
to instantiate any object that implements the Worker interface. If the command dispatcher is still
responsible for access control, then whenever programmers create a new class that implements
the Worker interface, they must remember to modify the dispatcher's access control code. If they
do not modify the access control code, then some Worker classes will not have any access control.
One way to address this access control problem is to make the Worker object responsible for
performing the access control check. An example of the re-refactored code follows:
Example Language: Java (Bad)
String ctl = request.getParameter("ctl");
Class cmdClass = Class.forName(ctl + "Command");
Worker ao = (Worker) cmdClass.newInstance();
ao.checkAccessControl(request);
ao.doAction(request);
Although this is an improvement, it encourages a decentralized approach to access control, which
makes it easier for programmers to make access control mistakes. This code also highlights
another security problem with using reflection to build a command dispatcher. An attacker can
invoke the default constructor for any kind of object. In fact, the attacker is not even constrained
to objects that implement the Worker interface; the default constructor for any object in the system
can be invoked. If the object does not implement the Worker interface, a ClassCastException will
be thrown before the assignment to ao, but if the constructor performs operations that work in
the attacker's favor, the damage will already have been done. Although this scenario is relatively
benign in simple products, in larger products where complexity grows exponentially it is not
unreasonable that an attacker could find a constructor to leverage as part of an attack.
Observed Examples
Reference Description
CVE-2018-1000613Cryptography API uses unsafe reflection when deserializing a private key
https://www.cve.org/CVERecord?id=CVE-2018-1000613
CWE Version 4.14
CWE-471: Modification of Assumed-Immutable Data (MAID)
CWE-471: Modification of Assumed-Immutable Data (MAID)