What is Comparison of Classes by Name (CWE-486)?

TL;DR: Comparison of Classes by Name (CWE-486) is a vulnerability where products compare classes based on their names, leading to incorrect or unintended code execution. Fix it using the getClass() method and == operator.

What is Comparison of Classes by Name?

Comparison of Classes by Name (CWE-486) is a vulnerability where products compare classes based on their names rather than using class equivalency methods. As defined by the MITRE Corporation under CWE-486, and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Comparison of Classes by Name occurs when a product compares classes solely based on their names instead of using proper type-checking mechanisms like getClass() method and == operator. This can lead to incorrect or unintended code execution, compromising system integrity and security. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fix

Jump to: Quick Summary · Comparison of Classes by Name Overview · How Comparison of Classes by Name Works · Business Impact of Comparison of Classes by Name · Comparison of Classes by Name Attack Scenario · How to Detect Comparison of Classes by Name · How to Fix Comparison of Classes by Name · Framework-Specific Fixes for Comparison of Classes by Name · How to Ask AI to Check Your Code for Comparison of Classes by Name · Comparison of Classes by Name Best Practices Checklist · Comparison of Classes by Name FAQ · Vulnerabilities Related to Comparison of Classes by Name · References · Scan Your Own Site

Comparison of Classes by Name Overview

What: Comparison of Classes by Name is a vulnerability where classes are compared based on their names rather than using proper type-checking mechanisms.

Why it matters: This can cause incorrect or unintended code execution, compromising system integrity and security.

Where it occurs: Most backend languages like Java, Python, Node.js, PHP, etc., where class comparison logic exists.

Who is affected: Applications that rely on comparing classes based on their names without proper type-checking mechanisms are at risk.

Who is NOT affected: Systems already using getClass() method and == operator for accurate type determination.

How Comparison of Classes by Name Works

Root Cause

The root cause is the reliance on class names to determine object types, which can be manipulated or ambiguous.

Attack Flow

1. An attacker manipulates a class name.
2. The application compares classes based on their names.
3. Incorrect or unintended code execution occurs.

Prerequisites to Exploit

• Class comparison logic relies solely on class names.
• Lack of proper type-checking mechanisms like getClass() method and == operator.

Vulnerable Code

public boolean isSameClass(Object obj) {
    return this.getClass().getName().equals(obj.getClass().getName());
}

This code compares classes based on their names, which can be manipulated to execute unintended or malicious code.

Secure Code

public boolean isSameClass(Object obj) {
    return this.getClass() == obj.getClass();
}

Using getClass() method and == operator ensures accurate type determination without relying on potentially ambiguous class names.

Business Impact of Comparison of Classes by Name

Confidentiality: Unauthorized access to sensitive data. Integrity: Incorrect or unintended code execution can modify system state. Availability: Potential disruption of services due to incorrect behavior.

• Financial loss from unauthorized transactions and data breaches.
• Compliance violations leading to regulatory fines.
• Reputational damage from compromised systems.

Comparison of Classes by Name Attack Scenario

1. Attacker manipulates a class name in the application’s input.
2. The application compares classes based on their names.
3. Incorrect or unintended code execution occurs, compromising system integrity and security.

How to Detect Comparison of Classes by Name

Manual Testing

• Review class comparison logic.
• Ensure use of getClass() method for type determination instead of relying on class names.

Automated Scanners (SAST/DAST)

Static analysis can identify direct string-based comparisons. Dynamic testing is needed to confirm actual execution paths and vulnerabilities.

PenScan Detection

PenScan’s scanner engines like ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap detect Comparison of Classes by Name vulnerabilities in various contexts.

False Positive Guidance

A finding is real if the class comparison logic relies solely on names without proper type-checking mechanisms. A false positive occurs when getClass() method and == operator are used correctly.

How to Fix Comparison of Classes by Name

• Replace string-based class name comparisons with getClass() method and == operator.
• Ensure accurate type determination using proper methods for object types.

Framework-Specific Fixes for Comparison of Classes by Name

Java

public boolean isSameClass(Object obj) {
    return this.getClass() == obj.getClass();
}

Using getClass() method and == operator ensures accurate type determination without relying on potentially ambiguous class names.

Python/Django

def is_same_class(obj):
    return isinstance(obj, type(self))

Node.js

function isSameClass(obj) {
    return this.constructor === obj.constructor;
}

PHP

public function isSameClass($obj) {
    return get_class($this) == get_class($obj);
}

Using getClass() method and == operator ensures accurate type determination without relying on potentially ambiguous class names.

How to Ask AI to Check Your Code for Comparison of Classes by Name

Comparison of Classes by Name Best Practices Checklist

• ✅ Use getClass() method and == operator for accurate type determination.
• ✅ Avoid relying on class names for object comparisons.
• ✅ Ensure proper validation and sanitization of input data.

Comparison of Classes by Name FAQ

How does Comparison of Classes by Name work?

It occurs when a product compares classes based on their names rather than using class equivalency methods, leading to potential execution of incorrect or unintended code.

Why is class equivalence important in preventing this vulnerability?

Using the getClass() method and == operator ensures accurate type determination without relying solely on potentially ambiguous class names.

Can you provide an example of vulnerable code for Comparison of Classes by Name?

Vulnerable code compares classes using their names, which can be manipulated to execute unintended or malicious code.

What are the manual testing steps to identify this vulnerability?

Review class comparison logic and ensure use of getClass() method for type determination instead of relying on class names.

How can I fix Comparison of Classes by Name in my code?

Replace string-based class name comparisons with getClass() method and == operator to accurately determine object types.

What are the business impacts of a Comparison of Classes by Name vulnerability?

It can lead to unauthorized execution of code, compromising system integrity, confidentiality, and availability.

How does an attacker exploit Comparison of Classes by Name vulnerabilities?

Attackers manipulate class names or use crafted inputs to execute unintended or malicious code.

Vulnerabilities Related to Comparison of Classes by Name

| CWE | Name | Relationship | |—|—|—| | CWE-1025 | Comparison Using Wrong Factors | ChildOf |

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Comparison of Classes by Name and other risks before an attacker does.