Weakness · High
CWE-578: EJB Bad Practices: Use of Class Loader
What it is
The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.
- Severity (our rating)
- High
- Likelihood of exploit
- Not rated by MITRE
- Introduced during
- Implementation
- Exploited in the wild
- No CVE in CISA's catalog
In more detail
The Enterprise JavaBeans specification requires that every bean provider follow a set of programming guidelines designed to ensure that the bean will be portable and behave consistently in any EJB container. In this case, the product violates the following EJB guideline: "The enterprise bean must not attempt to create a class loader; obtain the current class loader; set the context class loader; set security manager; create a new security manager; stop the JVM; or change the input, output, and error streams." The specification justifies this requirement in the following way: "These functions are reserved for the EJB container. Allowing the enterprise bean to use these functions could compromise security and decrease the container's ability to properly manage the runtime environment."
What an attacker can do
- Execute Unauthorized Code or Commands (Confidentiality, Integrity, Availability, Other)
- Varies by Context (Confidentiality, Integrity, Availability, Other)
How to prevent it
Architecture and Design
- Do not use the Class Loader when writing EJBs.
H2 Security
Found it in your code?
We review where it appears, fix it with your team, and check it was not already used against you.
Talk to our teamT Academy
Stop writing it in the first place
Learn to build software and systems without weaknesses like this one, with practice on real hosts in your browser, every objective checked on the machine.
Start freeSource: MITRE Common Weakness Enumeration, CWE version 4.19.1. CWE is a trademark of The MITRE Corporation.