...
APIs capable of bypassing SecurityManager's checks |
|---|
java.lang.Class.newInstance |
java.lang.Class.getClassLoader |
java.lang.Class.getClasses |
java.lang.Class.getField(s) |
java.lang.Class.getMethod(s) |
java.lang.Class.getConstructor(s) |
java.lang.Class.getDeclaredClasses |
java.lang.Class.getDeclaredField(s) |
java.lang.Class.getDeclaredMethod(s) |
java.lang.Class.getDeclaredConstructor(s) |
java.lang.ClassLoader.getParent |
java.lang.ClassLoader.getSystemClassLoader |
java.lang.Thread.getContextClassLoader |
Noncompliant Code Example
The createInstance method is the immediate caller of java.lang.Class.newInstance in this noncompliant example. The newInstance method is being invoked on the dateClass class object. The issue is that the untrustedCode method can trigger the instantiation of a new class even though it should not have the permission to do so. This behavior is not caught by the security manager.
...
A related issue is described in SEC04-J. Beware of standard APIs that perform access checks against the immediate caller.
Compliant Solution
Do not accept Class, ClassLoader or Thread instances from untrusted code. If inevitable, safely acquire these instances by ensuring they come from trusted sources. Additionally, make sure to discard tainted inputs from untrusted code. Likewise, objects returned by the affected methods should not be propagated back to the untrusted code.
Note that the Class.newInstance()} method requires the class to contain a no-argument constructor. If this requirement is not satisfied, a runtime exception results, which indirectly prevents a security breach.
Risk Assessment
Bypassing Securitymanager checks may seriously compromise the security of a Java application.
Rule | Severity | Likelihood | Remediation Cost | Priority | Level |
|---|---|---|---|---|---|
SEC02-J | medium | probable | medium | P8 | L2 |
Automated Detection
TODO
Related Vulnerabilities
Search for vulnerabilities resulting from the violation of this rule on the CERT website.
References
| Wiki Markup |
|---|
\[[Gong 03|AA. Java References#Gong 03]\] Section 4.3.2, Class Loader Delegation Hierarchy \[[SCG 07|AA. Java References#SCG 07]\] Guideline 6-2 Safely invoke standard APIs that bypass SecurityManager checks depending on the immediate caller's class loader |
...