CWE-499: Serializable Class Containing Sensitive Data
Serializable Class Containing Sensitive Data
Weakness ID: 499 (Weakness Variant)
Status: Draft
Description
Description Summary
The code contains a class with sensitive data, but the class does not explicitly deny serialization. The data can be accessed by serializing the class through another class.
Extended Description
Serializable classes are effectively open classes since data cannot be hidden in them. Classes that do not explicitly deny serialization can be serialized by any other class, which can then in turn use the data stored inside it.
Time of Introduction
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Confidentiality
Technical Impact: Read application
data
an attacker can write out the class to a byte stream, then extract the
important data from it.
Likelihood of Exploit
High
Demonstrative Examples
Example 1
This code creates a new record for a medical patient:
(Bad Code)
Example
Language: Java
class PatientRecord {
private String name;
private String socialSecurityNum;
public Patient(String name,String ssn) {
this.SetName(name);
this.SetSocialSecurityNumber(ssn);
}
}
This object does not explicitly deny serialization, allowing an
attacker to serialize an instance of this object and gain a patient's
name and Social Security number even though those fields are
private.
Potential Mitigations
Phase: Implementation
In Java, explicitly define final writeObject() to prevent
serialization. This is the recommended solution. Define the
writeObject() function to throw an exception explicitly denying
serialization.
Phase: Implementation
Make sure to prevent serialization of your objects.
Description
