Serializable Class Containing Sensitive Data

Opis

The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.

Serializable classes are effectively open classes since data cannot be hidden in them. Classes that do not explicitly deny serialization can be serialized by any other class, which can then in turn use the data stored inside it.

Skutki

• Confidentiality

  Read Application Data

  an attacker can write out the class to a byte stream, then extract the important data from it.

Zapobieganie

• Implementation

  In Java, explicitly define final writeObject() to prevent serialization. This is the recommended solution. Define the writeObject() function to throw an exception explicitly denying serialization.

• Implementation

  Make sure to prevent serialization of your objects.

Słabość nadrzędna

• CWE-668 Exposure of Resource to Wrong Sphere

Może prowadzić do

• CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

Kiedy powstaje

• Implementation

Dotyczy

Java

Źródła

1. The CLASP Application Security Process — Secure Software, Inc., 2005