What is Public cloneable() Method Without Final (CWE-491)?

TL;DR: Public cloneable() Method Without Final (‘Object Hijack’) (CWE-491) is a Java-specific vulnerability where an object can be cloned without calling the constructor, leading to unexpected states. Fix it by making the cloneable() method final.

What is Public cloneable() Method Without Final (‘Object Hijack’)?

Public cloneable() Method Without Final (‘Object Hijack’) (CWE-491) is a type of vulnerability that occurs in Java when an object can be cloned without calling the constructor, leading to unexpected states. As defined by the MITRE Corporation under CWE-491 and classified by the OWASP Foundation as not directly mapped.

Quick Summary

Public cloneable() Method Without Final (‘Object Hijack’) is a critical issue that affects data integrity and application stability in Java applications. It occurs when an object can be cloned without proper initialization, leading to inconsistent states. Jump to: Overview · How it works · Business Impact · Attack Scenario · Detection · Fix · Framework-Specific Fixes · Ask AI · Best Practices · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Public cloneable() Method Without Final (‘Object Hijack’) Overview · How Public cloneable() Method Without Final (‘Object Hijack’) Works · Business Impact of Public cloneable() Method Without Final (‘Object Hijack’) · Public cloneable() Method Without Final (‘Object Hijack’) Attack Scenario · How to Detect Public cloneable() Method Without Final (‘Object Hijack’) · How to Fix Public cloneable() Method Without Final (‘Object Hijack’) · Framework-Specific Fixes for Public cloneable() Method Without Final (‘Object Hijack’) · How to Ask AI to Check Your Code for Public cloneable() Method Without Final (‘Object Hijack’) · Public cloneable() Method Without Final (‘Object Hijack’) Best Practices Checklist · Public cloneable() Method Without Final (‘Object Hijack’) FAQ · Vulnerabilities Related to Public cloneable() Method Without Final (‘Object Hijack’) · References · Scan Your Own Site

Public cloneable() Method Without Final (‘Object Hijack’) Overview

What: A public cloneable() method without the final modifier allows subclasses to override cloning logic, bypassing constructor calls and leading to unexpected object states.

Why it matters: This can cause significant issues with data integrity and application stability by allowing objects to bypass initialization logic.

Where it occurs: In Java applications where classes have a public cloneable() method that is not declared final.

Who is affected: Developers and organizations using Java for backend development who rely on proper object cloning mechanisms.

Who is NOT affected: Systems already enforcing the use of final methods for cloning operations, or those utilizing alternative cloning techniques.

How Public cloneable() Method Without Final (‘Object Hijack’) Works

Root Cause

The root cause lies in the public cloneable() method not being declared final. This allows subclasses to override and potentially bypass constructor calls during cloning.

Attack Flow

1. An attacker identifies a class with a public, non-final cloneable() method.
2. The attacker creates a subclass that overrides the cloneable() method without calling the superclass constructor.
3. Cloning an instance of this subclass results in an object without proper initialization.

Prerequisites to Exploit

• A Java application must have a public cloneable() method declared as non-final.
• Subclasses must be able to override and manipulate cloning logic.

Vulnerable Code

public class ExampleClass {
    // Public, non-final cloneable method
    protected Object clone() throws CloneNotSupportedException {
        return super.clone();
    }
}

This code allows subclasses to bypass constructor calls during cloning.

Secure Code

public class ExampleClass {
    // Final cloneable method prevents subclass overrides
    protected final Object clone() throws CloneNotSupportedException {
        return super.clone();
    }
}

Declaring the cloneable() method as final ensures no subclass can override it, maintaining object consistency during cloning.

Business Impact of Public cloneable() Method Without Final (‘Object Hijack’)

Integrity: Objects may be in an unexpected state, leading to data corruption or inconsistent behavior when accessed.

• Example: A financial transaction record might not properly initialize its fields, causing incorrect balances.
• Consequences: Data integrity issues can lead to financial discrepancies and legal liabilities.

Public cloneable() Method Without Final (‘Object Hijack’) Attack Scenario

1. An attacker identifies a public non-final cloneable method in the application’s codebase.
2. The attacker creates a subclass that overrides this method without proper initialization logic.
3. Cloning an instance of this subclass results in an object bypassing constructor calls and entering an unexpected state.
4. The application processes objects in this inconsistent state, leading to potential data corruption or errors.

How to Detect Public cloneable() Method Without Final (‘Object Hijack’)

Manual Testing

• Check for public cloneable() methods that are not declared final.
• Verify if subclasses can override and manipulate cloning logic without proper initialization.

Automated Scanners (SAST / DAST)

Static analysis tools can detect non-final cloneable() methods, while dynamic testing is needed to confirm actual exploitation scenarios.

PenScan Detection

PenScan’s scanner engines such as ZAP and Nuclei are effective in identifying this vulnerability.

• ZAP: Detects public cloneable() methods without final modifier.
• Nuclei: Identifies potential cloning issues through template-based scanning.

False Positive Guidance

False positives may occur if the tool flags methods as vulnerable without considering the class structure or final keyword usage. Ensure that the method is indeed non-final and can be overridden by subclasses.

How to Fix Public cloneable() Method Without Final (‘Object Hijack’)

• Make the cloneable() method final.
• Verify that no subclass overrides this method improperly.
• Implement proper cloning logic within the superclass to ensure object consistency.

Framework-Specific Fixes for Public cloneable() Method Without Final (‘Object Hijack’)

public class ExampleClass {
    // Final cloneable method prevents subclass overrides
    protected final Object clone() throws CloneNotSupportedException {
        return super.clone();
    }
}

This ensures that no subclass can override the cloning logic improperly.

How to Ask AI to Check Your Code for Public cloneable() Method Without Final (‘Object Hijack’)

Public cloneable() Method Without Final (‘Object Hijack’) Best Practices Checklist

✅ Ensure all public cloneable() methods are declared as final. ✅ Verify that subclasses do not override cloning logic improperly. ✅ Implement proper initialization logic within the superclass to ensure object consistency.

Public cloneable() Method Without Final (‘Object Hijack’) FAQ

How does a public cloneable() method without final lead to an unexpected state?

A public cloneable() method allows subclasses to override the cloning process, potentially bypassing constructor calls and leading to objects in an inconsistent or uninitialized state.

Can you provide an example of vulnerable code for Public cloneable() Method Without Final (‘Object Hijack’)?

An example would be a class with a public cloneable() method that is not declared final, allowing subclasses to bypass constructor logic during cloning.

What are the potential impacts of Public cloneable() Method Without Final (‘Object Hijack’) on data integrity?

It can lead to objects being in an unexpected state, potentially causing data corruption or inconsistent behavior when accessed.

How does Public cloneable() Method Without Final (‘Object Hijack’) affect system availability?

Unexpected states may cause application crashes or errors that disrupt normal operation and service availability.

What are the best practices to prevent Public cloneable() Method Without Final (‘Object Hijack’) in Java applications?

Declaring the cloneable() method final ensures no subclass can override it, maintaining object consistency during cloning.

How does Public cloneable() Method Without Final (‘Object Hijack’) relate to other security vulnerabilities?

It is a specific variant of CWE-668 (Exposure of Resource to Wrong Sphere), where the resource exposed is an object’s state.

What are some common false positives when detecting Public cloneable() Method Without Final (‘Object Hijack’) using automated tools?

False positives may occur if the tool flags methods as vulnerable without considering the class structure or final keyword usage.

Vulnerabilities Related to Public cloneable() Method Without Final (‘Object Hijack’)

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Public cloneable() Method Without Final (‘Object Hijack’) and other risks before an attacker does.