What is Array Declared Public, Final, and Static (CWE-582)?

TL;DR: Array Declared Public, Final, and Static (CWE-582) is a security vulnerability where an array’s contents can be modified due to improper declaration. Fix it by using proper access control.

What is Array Declared Public, Final, and Static?

Array Declared Public, Final, and Static (CWE-582) is a type of security vulnerability that occurs when an array in a class is declared as public, final, and static. This declaration allows the array’s contents to be modified from anywhere within the application, leading to potential data integrity issues.

As defined by the MITRE Corporation under CWE-582, and classified by the OWASP Foundation under [No official mapping], this vulnerability highlights the importance of proper access control for sensitive data structures in software applications.

Quick Summary

Array Declared Public, Final, and Static is a security risk that arises when arrays are improperly declared as public, final, and static. This can lead to unauthorized modifications of array contents, compromising application integrity. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixes · Framework-Specific Fixes · Ask AI · Best Practices Checklist · FAQ

Jump to: Quick Summary · Array Declared Public, Final, and Static Overview · How Array Declared Public, Final, and Static Works · Business Impact of Array Declared Public, Final, and Static · Array Declared Public, Final, and Static Attack Scenario · How to Detect Array Declared Public, Final, and Static · How to Fix Array Declared Public, Final, and Static · Framework-Specific Fixes for Array Declared Public, Final, and Static · How to Ask AI to Check Your Code for Array Declared Public, Final, and Static · Array Declared Public, Final, and Static Best Practices Checklist · Array Declared Public, Final, and Static FAQ · Vulnerabilities Related to Array Declared Public, Final, and Static · References · Scan Your Own Site

Array Declared Public, Final, and Static Overview

What

Array Declared Public, Final, and Static is a vulnerability where arrays declared with public, final, and static modifiers can be accessed and modified from any part of the application.

Why it matters

This weakness exposes sensitive data to unauthorized modifications, leading to potential integrity issues. Proper access control is crucial for maintaining secure code practices.

Where it occurs

It commonly appears in Java, Python, C#, and .NET applications where arrays are used as static resources.

Who is affected

Developers who declare arrays with these modifiers inadvertently expose them to tampering risks.

Who is NOT affected

Applications that strictly control access to sensitive data structures via proper encapsulation techniques.

How Array Declared Public, Final, and Static Works

Root Cause

The root cause lies in the improper declaration of an array as public, final, and static, which allows it to be accessed and modified from any part of the application.

Attack Flow

1. Attacker identifies a publicly accessible static array.
2. Modifies the contents of the array through direct access or by exploiting other vulnerabilities within the application.
3. The compromised data leads to unexpected behavior or security breaches.

Prerequisites to Exploit

• Access to the public, final, and static array declaration.
• Ability to modify the array’s contents directly.

Vulnerable Code

public final class Config {
    public static final String[] CONFIG_DATA = {"value1", "value2"};
}

This code exposes the CONFIG_DATA array to potential tampering from any part of the application.

Secure Code

public final class Config {
    private static final String[] CONFIG_DATA = {"value1", "value2"};
}

By declaring the array as private, it ensures that only authorized parts of the application can access and modify its contents.

Business Impact of Array Declared Public, Final, and Static

Integrity

• Example: Unauthorized modification of static configuration data.
• Consequences:
  • Data corruption leading to system instability or incorrect behavior.
  • Security vulnerabilities due to altered sensitive information.

Availability

• Example: Malicious tampering causing application downtime.
• Consequences:
  • Service disruptions due to compromised configurations.
  • Increased maintenance costs for recovery and patching.

Array Declared Public, Final, and Static Attack Scenario

1. Attacker identifies a public static final array in the configuration file of an application.
2. Modifies the contents of this array through direct access or by exploiting other vulnerabilities within the system.
3. The compromised data leads to unexpected behavior or security breaches, potentially causing service disruptions.

How to Detect Array Declared Public, Final, and Static

Manual Testing

• Review code for arrays declared as public, final, and static.
• Ensure that such declarations are properly encapsulated with appropriate access modifiers.
• Verify that sensitive data structures are not globally accessible.

Automated Scanners (SAST/DAST)

Static analysis can detect improper array declarations. Dynamic testing is required to confirm actual exploitation scenarios.

PenScan Detection

PenScan’s scanner engines, including ZAP and Nuclei, actively identify code patterns where arrays are declared as public, final, and static without proper access controls.

False Positive Guidance

False positives may occur if the array declaration appears risky but is actually safe due to context not visible to the scanner. Verify that the array is indeed accessible from unauthorized parts of the application before marking it as a false positive.

How to Fix Array Declared Public, Final, and Static

• Ensure arrays are declared with appropriate access modifiers (e.g., private or protected).
• Restrict access to sensitive data structures by encapsulating them within secure classes.
• Use proper encapsulation techniques to prevent unauthorized modifications of static resources.

Framework-Specific Fixes for Array Declared Public, Final, and Static

Java

public final class Config {
    private static final String[] CONFIG_DATA = {"value1", "value2"};
}

By declaring the array as private, it ensures that only authorized parts of the application can access and modify its contents.

How to Ask AI to Check Your Code for Array Declared Public, Final, and Static

Array Declared Public, Final, and Static Best Practices Checklist

✅ Ensure arrays are declared with appropriate access modifiers. ✅ Restrict access to sensitive data structures within secure classes. ✅ Use encapsulation techniques to prevent unauthorized modifications of static resources.

Array Declared Public, Final, and Static FAQ

How does declaring an array public, final, and static lead to security vulnerabilities?

When an array is declared as public, final, and static in a class, it can be accessed from anywhere within the application. This can allow unauthorized modification of its contents.

What are the potential consequences of Array Declared Public, Final, and Static?

The primary consequence is that data integrity may be compromised due to unauthorized modifications to array contents.

How does an attacker exploit Array Declared Public, Final, and Static?

An attacker can modify the static array’s values from any part of the application where it is accessible, leading to unexpected behavior or security breaches.

Can you provide a real-world example of vulnerable code for Array Declared Public, Final, and Static?

A common scenario involves a public static final array used in a configuration file that can be altered by malicious actors.

How does PenScan detect Array Declared Public, Final, and Static vulnerabilities?

PenScan uses automated scanners to identify code patterns where arrays are declared as public, final, and static without proper access controls.

What is the best practice for preventing Array Declared Public, Final, and Static in Java applications?

In Java, ensure that sensitive arrays are not declared as public, final, and static. Instead, use appropriate access modifiers like private or protected.

How can developers mitigate Array Declared Public, Final, and Static risks in Python code?

Developers should avoid making mutable data structures like lists or dictionaries globally accessible by declaring them as non-static class members.

Vulnerabilities Related to Array Declared Public, Final, and Static

References

• MITRE - CWE-582
• NVD NIST

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Array Declared Public, Final, and Static and other risks before an attacker does.