Book a Security Review

Weakness · High

CWE-493: Critical Public Variable Without Final Modifier

What it is

The product has a critical public variable that is not final, which allows the variable to be modified to contain unexpected values.

Likelihood of exploit: HighMITRE CWE 4.19.1

Severity (our rating)
High
Likelihood of exploit
High
Introduced during
Implementation
Exploited in the wild
No CVE in CISA's catalog

In more detail

If a field is non-final and public, it can be changed once the value is set by any function that has access to the class which contains the field. This could lead to a vulnerability if other parts of the program make assumptions about the contents of that field.

What an attacker can do

  • Modify Application Data (Integrity)
  • Read Application Data (Confidentiality)

How to prevent it

Implementation

  • Declare all public fields as final when possible, especially if it is used to maintain internal state of an Applet or of classes used by an Applet. If a field must be public, then perform all appropriate sanity checks before accessing the field from your code.

How to find it

  • Automated Static Analysis. Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)

CWE-493 on MITRE's CWE site

H2 Security

Found it in your code?

We review where it appears, fix it with your team, and check it was not already used against you.

Talk to our team

T Academy

Stop writing it in the first place

Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.

Start free

Source: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.