CWE-594: J2EE Framework: Saving Unserializable Objects to Disk
J2EE Framework: Saving Unserializable Objects to Disk
Weakness ID: 594 (Weakness Variant)
Status: Incomplete
Description
Description Summary
When the J2EE container attempts to write unserializable
objects to disk there is no guarantee that the process will complete
successfully.
Time of Introduction
Architecture and Design
Implementation
Applicable Platforms
Languages
Java
Common Consequences
Scope
Effect
Integrity
Data represented by unserializable objects can be corrupted.
Availability
Non-serializability of objects can lead to system crash.
Potential Mitigations
Phase
Description
Design through Implementation: All objects that become part of session
and application scope must implement the java.io.Serializable interface
to ensure serializability of containing objects.
Other Notes
In heavy load conditions, most J2EE application frameworks flush objects
to disk to manage memory requirements of incoming requests. For example,
session scoped objects, and even application scoped objects, are written to
disk when required. While these application frameworks do the real work of
writing objects to disk, they do not enforce that those objects be
serializable, thus leaving your web application vulnerable to serialization
failure induced crashes. An attacker may be able to mount a denial of
service attack by sending enough requests to the server to force the web
application to save objects to disk.
Description
