...

Improper use of public static fields can also lead to type safety issues. For example, untrusted code might supply an unexpected subtype when the variable is defined to be of a more general type such as {{java.lang.Object}}. \[[Gong 03|AA. Java References#Gong 03]\]

Noncompliant Code Example

This is an example from the JDK 1.4.2 software \[[Function Table|#ref3]\].

...

Replacing the function table gives the attacker access to the XPathContext used to evaluate XPath expressions. The XPathContext is used to set the reference node for evaluating XPath expressions. Manipulating this can cause unexpected behavior and XML fields can be modified in inconsistent ways. Also, static variables are global across the Java Runtime Environment (JRE). They can be used as a communication channel between different application domains (e.g., through code loaded by different class loaders).

Compliant Solution

Treat public static fields as constants and declare them as final. Consider the use of enum types in the following example.

...

...
public static final FuncLoader m_functions;
...

Compliant Solution

Additionally, for mutable static state one can define assessor methods and add appropriate security checks. Note that this is a different example, wherein the scope of the static variable has been changed to private.

...

As a cautionary note however, simply changing the modifier to final may not prevent attackers from indirectly retrieving an incorrect value from the static final variable before its initialization. See MSC00-J. Eliminate class initialization cycles and OBJ03-J. Be careful about final reference for more on this problem.

Risk Assessment

Unauthorized modifications to public static variables can result in unexpected behavior and can bypass important security checks and/or invoke malicious code.

References

\[[FT 08|AA. Java References#FT 08]\] 
\[[Nisewanger 07|AA. Java References#Nisewanger 07]\] Antipattern 5, Misusing Public Static Variables
\[[SCG 07|AA. Java References#SCG 07]\] Guideline 3.1, Treat public static fields as constants
\[[Gong 03|AA. Java References#Gong 03]\] 9.3 Static Fields
\[[MITRE 09|AA. Java References#MITRE 09]\] [CWE ID 582|http://cwe.mitre.org/data/definitions/582.html] "Array Declared Public, Final, and Static", [CWE ID 493|http://cwe.mitre.org/data/definitions/493.html] "Critical Public Variable Without Final Modifier", [CWE ID 500|http://cwe.mitre.org/data/definitions/500.html] "Public Static Field Not Marked Final"

...