What is Public Static Field Not Marked Final (CWE-500)?

TL;DR: Public Static Field Not Marked Final (CWE-500) is a security vulnerability where public static fields can be modified unexpectedly, compromising data integrity. Ensure these fields are marked final and private.

What is Public Static Field Not Marked Final?

Public Static Field Not Marked Final (CWE-500) is a type of security vulnerability that occurs when an object contains a public static field that is not marked final. As defined by the MITRE Corporation under CWE-500, and classified by the OWASP Foundation under A05:2025 - Injection…

Quick Summary

Public Static Field Not Marked Final vulnerabilities can lead to data tampering and unauthorized access, compromising critical application data integrity. This issue is particularly relevant in environments where static fields are used extensively without proper protection.

Jump to: Quick Summary · Public Static Field Not Marked Final Overview · How Public Static Field Not Marked Final Works · Business Impact of Public Static Field Not Marked Final · Public Static Field Not Marked Final Attack Scenario · How to Detect Public Static Field Not Marked Final · How to Fix Public Static Field Not Marked Final · Framework-Specific Fixes for Public Static Field Not Marked Final · How to Ask AI to Check Your Code for Public Static Field Not Marked Final · Public Static Field Not Marked Final Best Practices Checklist · Public Static Field Not Marked Final FAQ · Vulnerabilities Related to Public Static Field Not Marked Final · References · Scan Your Own Site

Public Static Field Not Marked Final Overview

What

Public Static Field Not Marked Final is a security vulnerability where public static fields are not marked final, allowing them to be modified unexpectedly.

Why it matters

This can lead to data tampering and unauthorized access, compromising the integrity of critical application data.

Where it occurs

It commonly affects applications that use static fields extensively without proper protection mechanisms.

Who is affected

Developers and organizations using Java, Python, Node.js, or similar languages are at risk if they do not properly secure their public static fields.

Who is NOT affected

Systems already implementing strict final modifiers on critical data elements are generally immune to this issue.

How Public Static Field Not Marked Final Works

Root Cause

Public static fields without the ‘final’ modifier can be modified after initialization, leading to unexpected behavior and security risks.

Attack Flow

1. An attacker identifies a public static field that is not marked final.
2. The attacker modifies this field through external means.
3. The application processes the altered data, causing unintended consequences.

Prerequisites to Exploit

• A public static field without ‘final’ modifier.
• External access to modify the field’s value.

Vulnerable Code

public class Example {
    public static String configValue = "default";
}

This code is vulnerable because it allows external modification of configValue.

Secure Code

public class Example {
    private static final String CONFIG_VALUE = "default";
}

The secure version marks the field as ‘final’ and makes it private, preventing any modifications after initialization.

Business Impact of Public Static Field Not Marked Final

Confidentiality

• Exposes sensitive data to unauthorized access.
• Example: An attacker modifies a static configuration value containing sensitive information.

Integrity

• Allows tampering with critical application data.
• Example: A public static field holding encryption keys is altered, leading to compromised security.

Availability

• Disrupts normal system operations through unexpected modifications.
• Example: Modifying a static field that controls access permissions can lead to service disruptions.

Business Consequences

• Financial losses due to unauthorized transactions or data breaches.
• Non-compliance with regulatory standards like GDPR and HIPAA.
• Damage to reputation from security incidents and loss of customer trust.

Public Static Field Not Marked Final Attack Scenario

1. An attacker identifies a public static field in the application code.
2. The attacker modifies this field through external means, such as by injecting malicious input or exploiting misconfigurations.
3. The modified value is processed by the application, leading to unexpected behavior and security risks.

How to Detect Public Static Field Not Marked Final

Manual Testing

• Review all public static fields in the codebase.
• Check if they are marked final and private.
• Ensure no external access can modify these fields.

Automated Scanners (SAST / DAST)

Static analysis tools can detect unmarked static fields, while dynamic scanners can simulate attacks to identify vulnerabilities.

PenScan Detection

PenScan’s scanner engines like ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap are effective in identifying this vulnerability.

False Positive Guidance

A finding is real if the static field can be modified externally; otherwise, it may be a false positive due to proper protection mechanisms already in place.

How to Fix Public Static Field Not Marked Final

• Clearly identify the scope for all critical data elements.
• Make any static fields private and constant using ‘final’ modifiers.
• Ensure no external access can modify these fields after initialization.

Framework-Specific Fixes for Public Static Field Not Marked Final

Java

public class Example {
    private static final String CONFIG_VALUE = "default";
}

Python/Django

class Config:
    CONFIG_VALUE = 'default'

Node.js

const config = { value: 'default' };
Object.freeze(config);

How to Ask AI to Check Your Code for Public Static Field Not Marked Final

Public Static Field Not Marked Final Best Practices Checklist

✅ Clearly identify critical data elements in your application. ✅ Make all public static fields private and constant with ‘final’ modifiers. ✅ Ensure no external access can modify these fields after initialization. ✅ Regularly review and update security practices to prevent this vulnerability.

Public Static Field Not Marked Final FAQ

How does the Public Static Field Not Marked Final vulnerability work?

It allows public static fields to be modified in unexpected ways, potentially leading to data tampering or unauthorized access.

Why is marking a static field as final important?

Making it final prevents changes to its value after initialization, ensuring integrity and preventing unintended modifications.

Can you provide an example of vulnerable code for Public Static Field Not Marked Final?

A public static field without the ‘final’ modifier can be changed by external sources, leading to potential security risks.

How do I detect Public Static Field Not Marked Final in my application?

Use manual testing techniques and automated scanners like PenScan’s engines to identify fields that are not marked final.

What is the impact of a Public Static Field Not Marked Final vulnerability on an application?

It can lead to data integrity issues, unauthorized access, and potential security breaches.

How do I fix Public Static Field Not Marked Final in my code?

Ensure all critical static fields are marked as ‘final’ and private to prevent modification after initialization.

What is the best practice for preventing Public Static Field Not Marked Final vulnerabilities?

Clearly identify the scope of critical data elements and ensure they are properly protected, such as by using final modifiers.

Vulnerabilities Related to Public Static Field Not Marked Final

References

• MITRE
• OWASP Injection
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Public Static Field Not Marked Final and other risks before an attacker does.