CWE-498: Cloneable Class Containing Sensitive Information
Cloneable Class Containing Sensitive Information
Weakness ID: 498 (Weakness Variant)
Status: Draft
Description
Description Summary
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
Extended Description
Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that do not explicitly deny cloning can be cloned by any other class without running the constructor.
Time of Introduction
Implementation
Applicable Platforms
Languages
C++
Java
.NET
Common Consequences
Scope
Effect
Access Control
Technical Impact: Bypass protection
mechanism
A class that can be cloned can be produced without executing the
constructor. This is dangerous since the constructor may perform
security-related checks. By allowing the object to be cloned, those
checks may be bypassed.
Likelihood of Exploit
Medium
Demonstrative Examples
Example 1
(Bad Code)
Example
Language: Java
public class CloneClient {
public CloneClient() //throws
java.lang.CloneNotSupportedException {
Teacher t1 = new Teacher("guddu","22,nagar road");
//...
// Do some stuff to remove the teacher.
Teacher t2 = (Teacher)t1.clone();
System.out.println(t2.name);
}
public static void main(String args[]) {
new CloneClient();
}
}
class Teacher implements Cloneable {
public Object clone() {
try {
return super.clone();
}
catch (java.lang.CloneNotSupportedException e) {
throw new RuntimeException(e.toString());
}
}
public String name;
public String clas;
public Teacher(String name,String clas) {
this.name = name;
this.clas = clas;
}
}
Potential Mitigations
Phase: Implementation
Make classes uncloneable by defining a clone function like:
(Mitigation Code)
Example
Language: Java
public final void clone() throws
java.lang.CloneNotSupportedException {
throw new java.lang.CloneNotSupportedException();
}
Phase: Implementation
If you do make your classes clonable, ensure that your clone method is
final and throw super.clone().
Description
