What is Access to Critical Private Variable via (CWE-767)?

TL;DR: Access to Critical Private Variable via Public Method (CWE-767) is a vulnerability where public methods improperly interact with sensitive data, compromising integrity and confidentiality. Proper access controls and validation are essential for mitigation.

What is Access to Critical Private Variable via Public Method?

Access to Critical Private Variable via Public Method (CWE-767) is a type of vulnerability that occurs when a public method in an application improperly accesses or modifies critical private variables. As defined by the MITRE Corporation under CWE-767, and classified by the OWASP Foundation as not directly mapped…

Quick Summary

Access to Critical Private Variable via Public Method (CWE-767) is a significant security risk that can lead to unauthorized modifications of application data and potential exposure of confidential information. This vulnerability arises when public methods improperly interact with sensitive private variables, compromising system integrity and confidentiality.

Jump to: Quick Summary · Access to Critical Private Variable via Public Method Overview · How Access to Critical Private Variable via Public Method Works · Business Impact of Access to Critical Private Variable via Public Method · Access to Critical Private Variable via Public Method Attack Scenario · How to Detect Access to Critical Private Variable via Public Method · How to Fix Access to Critical Private Variable via Public Method · Framework-Specific Fixes for Access to Critical Private Variable via Public Method · How to Ask AI to Check Your Code for Access to Critical Private Variable via Public Method · Access to Critical Private Variable via Public Method Best Practices Checklist · Access to Critical Private Variable via Public Method FAQ · Vulnerabilities Related to Access to Critical Private Variable via Public Method · References · Scan Your Own Site

Access to Critical Private Variable via Public Method Overview

What

Access to Critical Private Variable via Public Method is a security vulnerability where public methods improperly interact with sensitive private variables, leading to unauthorized modifications or exposure of data.

Why it matters

This vulnerability can lead to significant business consequences such as financial loss due to data breaches, non-compliance penalties, and damage to reputation.

Where it occurs

It commonly occurs in applications that do not properly validate input from public methods before modifying private variables.

Who is affected

Developers and organizations using any backend language (Java, Python, Node.js, PHP) are at risk if their code improperly handles critical private variables via public methods.

Who is NOT affected

Applications with robust validation mechanisms in place to ensure proper access controls for private variables are not vulnerable to this issue.

How Access to Critical Private Variable via Public Method Works

Root Cause

The root cause of this vulnerability lies in the improper design and implementation of class accessor and mutator methods, which expose critical private variables through public interfaces without adequate validation or security checks.

Attack Flow

1. An attacker identifies a public method that improperly interacts with sensitive data.
2. The attacker exploits this method to access or modify critical private variables.
3. Unauthorized modifications lead to potential exposure of confidential information and integrity breaches.

Prerequisites to Exploit

• A public method must exist that accesses or modifies a critical private variable.
• Proper validation mechanisms for the public method are missing or insufficient.

Vulnerable Code

public class ExampleClass {
    private String sensitiveData;

    public void setSensitiveData(String data) {
        this.sensitiveData = data;
    }
}

This code allows any caller to modify sensitiveData without proper validation, making it vulnerable to unauthorized access.

Secure Code

public class ExampleClass {
    private String sensitiveData;

    public void setSensitiveData(String data) {
        if (isValidInput(data)) {
            this.sensitiveData = data;
        } else {
            throw new IllegalArgumentException("Invalid input");
        }
    }

    private boolean isValidInput(String data) {
        // Perform validation checks
        return true;  // Placeholder for actual validation logic
    }
}

This secure version ensures proper validation before modifying sensitiveData, mitigating the risk of unauthorized access.

Business Impact of Access to Critical Private Variable via Public Method

Confidentiality

• Unauthorized exposure of sensitive data stored in private variables.
• Potential for data breaches and loss of confidential information.

Integrity

• Unauthorized modifications of critical application data through public methods.
• Compromise of system integrity due to improper handling of private variables.

Availability

• No direct impact on availability, but indirect effects such as downtime during remediation efforts.

Business Consequences:

1. Financial losses from data breaches and non-compliance penalties.
2. Damage to reputation and customer trust due to security incidents.
3. Increased costs for incident response and recovery operations.

Access to Critical Private Variable via Public Method Attack Scenario

1. An attacker identifies a public method that improperly interacts with sensitive private variables.
2. The attacker exploits this method by providing malicious input to modify critical data.
3. Unauthorized modifications lead to potential exposure of confidential information.
4. System integrity is compromised, leading to further security risks.

How to Detect Access to Critical Private Variable via Public Method

Manual Testing

• Review public methods for proper validation and access controls before modifying private variables.
• Ensure that any interaction with critical data is properly validated and secured.

Automated Scanners (SAST / DAST)

• Static analysis can identify methods lacking proper validation, while dynamic testing can simulate attacks to verify vulnerabilities.

PenScan Detection

PenScan’s scanner engines like ZAP and Wapiti are configured to detect public methods that improperly interact with critical private variables.

False Positive Guidance

False positives may occur if the method appears risky but is actually safe due to context a scanner cannot determine. Verify the actual validation logic in place for accurate detection.

How to Fix Access to Critical Private Variable via Public Method

• Use class accessor and mutator methods appropriately.
• Perform thorough data validation when accepting input from public methods intended to modify critical private variables.
• Ensure appropriate access controls are applied when a public method interfaces with sensitive data.

Framework-Specific Fixes for Access to Critical Private Variable via Public Method

Java

public class ExampleClass {
    private String sensitiveData;

    public void setSensitiveData(String data) {
        if (isValidInput(data)) {
            this.sensitiveData = data;
        } else {
            throw new IllegalArgumentException("Invalid input");
        }
    }

    private boolean isValidInput(String data) {
        // Perform validation checks
        return true;  // Placeholder for actual validation logic
    }
}

Python/Django

class ExampleClass:
    def __init__(self):
        self.sensitive_data = None

    def set_sensitive_data(self, data):
        if self.is_valid_input(data):
            self.sensitive_data = data
        else:
            raise ValueError("Invalid input")

    def is_valid_input(self, data):
        # Perform validation checks
        return True  # Placeholder for actual validation logic

Node.js

class ExampleClass {
    constructor() {
        this.sensitiveData = null;
    }

    setSensitiveData(data) {
        if (this.isValidInput(data)) {
            this.sensitiveData = data;
        } else {
            throw new Error("Invalid input");
        }
    }

    isValidInput(data) {
        // Perform validation checks
        return true;  // Placeholder for actual validation logic
    }
}

PHP

class ExampleClass {
    private $sensitiveData;

    public function setSensitiveData($data) {
        if ($this->isValidInput($data)) {
            $this->sensitiveData = $data;
        } else {
            throw new Exception("Invalid input");
        }
    }

    private function isValidInput($data) {
        // Perform validation checks
        return true;  // Placeholder for actual validation logic
    }
}

How to Ask AI to Check Your Code for Access to Critical Private Variable via Public Method

Access to Critical Private Variable via Public Method Best Practices Checklist

✅ Use class accessor and mutator methods appropriately. ✅ Perform thorough data validation when accepting input from public methods intended to modify critical private variables. ✅ Ensure appropriate access controls are applied when a public method interfaces with sensitive data. ✅ Regularly review and update security practices for handling critical private variables.

Access to Critical Private Variable via Public Method FAQ

How does Access to Critical Private Variable via Public Method occur?

This vulnerability occurs when a public method in an application allows unauthorized access or modification of critical private variables, compromising the integrity of sensitive data.

What are the consequences of this vulnerability?

It can lead to unauthorized modifications of application data and potential exposure of confidential information, impacting both security and compliance requirements.

How can I detect Access to Critical Private Variable via Public Method in my codebase?

Manual testing involves reviewing public methods that interact with private variables for proper validation and access controls. Automated scanners like PenScan can also help identify such issues efficiently.

What are the best practices to prevent this vulnerability?

Use class accessor and mutator methods appropriately, perform thorough data validation when accepting input from public methods, and ensure appropriate access controls are applied.

Can you provide an example of vulnerable code for Access to Critical Private Variable via Public Method?

A public method that directly accesses or modifies a private variable without proper validation can be considered vulnerable. Secure coding practices should enforce strict validation before allowing any modifications.

How does PenScan help in detecting this vulnerability?

scanner engines like ZAP and Wapiti are configured to identify such issues by analyzing the codebase for public methods that improperly interact with critical private variables.

What is the relationship between CWE-767 and other weaknesses?

CWE-767 can be a child of broader exposure vulnerabilities, such as CWE-668 (Exposure of Resource to Wrong Sphere).

Vulnerabilities Related to Access to Critical Private Variable via Public Method

References

• MITRE
• CAPEC
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Access to Critical Private Variable via Public Method and other risks before an attacker does.