What is Returning a Mutable Object (CWE-375)?

TL;DR: Returning a Mutable Object to an Untrusted Caller (CWE-375) occurs when mutable data is sent as a return value without being cloned, allowing the calling function to alter or delete it.

What is Returning a Mutable Object to an Untrusted Caller?

Returning a Mutable Object to an Untrusted Caller (CWE-375) is a type of security misconfiguration vulnerability that occurs when mutable data is sent as a return value without being cloned. As defined by the MITRE Corporation under CWE-375, and classified by the OWASP Foundation under No official mapping…

Quick Summary

Returning a Mutable Object to an Untrusted Caller (CWE-375) can have significant business impacts on confidentiality, integrity, and availability. This vulnerability occurs when mutable data is sent as a return value without being cloned, allowing the calling function to alter or delete it.

Jump to: Quick Summary · Returning a Mutable Object to an Untrusted Caller Overview · How Returning a Mutable Object to an Untrusted Caller Works · Business Impact of Returning a Mutable Object to an Untrusted Caller · Returning a Mutable Object to an Untrusted Caller Attack Scenario · How to Detect Returning a Mutable Object to an Untrusted Caller · How to Fix Returning a Mutable Object to an Untrusted Caller · Framework-Specific Fixes for Returning a Mutable Object to an Untrusted Caller · How to Ask AI to Check Your Code for Returning a Mutable Object to an Untrusted Caller · Returning a Mutable Object to an Untrusted Caller Best Practices Checklist · Returning a Mutable Object to an Untrusted Caller FAQ · Vulnerabilities Related to Returning a Mutable Object to an Untrusted Caller · References · Scan Your Own Site

Returning a Mutable Object to an Untrusted Caller Overview

What: Returning a Mutable Object to an Untrusted Caller (CWE-375) is a type of security misconfiguration vulnerability that occurs when mutable data is sent as a return value without being cloned.

Why it matters: This vulnerability can lead to modifying memory and potentially tampering with data, which can have significant business impacts on confidentiality, integrity, and availability.

Where it occurs: This vulnerability typically occurs in Java, C++, Python, Node.js, or PHP applications that use mutable objects as return values without cloning them first.

Who is affected: Applications that use mutable objects as return values without cloning them first are at risk of this vulnerability.

Who is NOT affected: Applications that never construct paths/queries/commands from external input and systems already using the primary fix technique of cloning mutable data before returning references to it are not affected by this vulnerability.

How Returning a Mutable Object to an Untrusted Caller Works

Root Cause

The root cause of this vulnerability is sending non-cloned mutable data as a return value, allowing the calling function to alter or delete it.

Attack Flow

1. The attacker sends a request to the application with malicious input.
2. The application processes the input and returns a mutable object as a return value without cloning it first.
3. The calling function alters or deletes the returned mutable object.

Prerequisites to Exploit

• Mutable data is sent as a return value without being cloned.
• The calling function has access to the returned mutable object.

Vulnerable Code

public class Example {
  public static void main(String[] args) {
    String mutableData = "Hello, World!";
    return mutableData;
  }
}

This code returns a mutable string as a return value without cloning it first, making it vulnerable to this attack.

Secure Code

public class Example {
  public static void main(String[] args) {
    String immutableData = new String("Hello, World!");
    return immutableData;
  }
}

This code returns an immutable string as a return value by cloning the mutable data first, making it secure against this attack.

Business Impact of Returning a Mutable Object to an Untrusted Caller

Confidentiality: The attacker can modify or delete sensitive data, leading to unauthorized access and potential data breaches.

Integrity: The attacker can modify or delete data, leading to inaccurate or incomplete information.

Availability: The attacker can cause the application to become unavailable, leading to downtime and lost productivity.

Real-world business consequences:

• Financial losses due to data breaches or unauthorized access.
• Compliance issues due to failure to protect sensitive data.
• Reputation damage due to public disclosure of security incidents.

Returning a Mutable Object to an Untrusted Caller Attack Scenario

1. The attacker sends a request to the application with malicious input.
2. The application processes the input and returns a mutable object as a return value without cloning it first.
3. The calling function alters or deletes the returned mutable object, leading to unauthorized access or data breaches.

How to Detect Returning a Mutable Object to an Untrusted Caller

Manual Testing

• Review code for potential vulnerabilities.
• Test application with malicious input to simulate attack scenario.

Automated Scanners (SAST/DAST)

• Use SAST tools to scan code for potential vulnerabilities.
• Use DAST tools to test application with malicious input to simulate attack scenario.

PenScan Detection

• PenScan’s scanner engines actively test for this issue.

False Positive Guidance

• Be cautious of false positives due to similar-looking patterns in code.
• Verify findings through manual testing and review of code.

How to Fix Returning a Mutable Object to an Untrusted Caller

• Clone mutable data before returning references to it.

Framework-Specific Fixes for Returning a Mutable Object to an Untrusted Caller

Java

public class Example {
  public static void main(String[] args) {
    String immutableData = new String("Hello, World!");
    return immutableData;
  }
}

Node.js

const example = () => {
  const mutableData = "Hello, World!";
  return Object.freeze(mutableData);
};

Python/Django

from types import ImmutableString

class Example:
  def main(self):
    mutable_data = "Hello, World!"
    return ImmutableString(mutable_data)

PHP

class Example {
  public function main() {
    $mutableData = "Hello, World!";
    return (object)array('data' => $mutableData);
  }
}

How to Ask AI to Check Your Code for Returning a Mutable Object to an Untrusted Caller

You can use the copy-paste prompt provided by PenScan to review your code for potential vulnerabilities and rewrite it using the primary fix technique.

Returning a Mutable Object to an Untrusted Caller Best Practices Checklist

✅ Clone mutable data before returning references to it. ✅ Verify return values are correct and immutable. ✅ Test application with malicious input to simulate attack scenario.

Returning a Mutable Object to an Untrusted Caller FAQ

How does Returning a Mutable Object to an Untrusted Caller occur?

This occurs when mutable data is sent as a return value without being cloned, allowing the calling function to alter or delete it.

What are the common consequences of Returning a Mutable Object to an Untrusted Caller?

The common consequences include modifying memory and potentially tampering with data.

How can I detect Returning a Mutable Object to an Untrusted Caller in my code?

You can use manual testing, automated scanners (SAST/DAST), or PenScan’s detection capabilities.

What are the recommended mitigations for Returning a Mutable Object to an Untrusted Caller?

The recommended mitigations include declaring returned data as constant or immutable and cloning mutable data before returning references to it.

How can I prevent Returning a Mutable Object to an Untrusted Caller in my code?

You can use the primary fix technique of cloning mutable data before returning references to it.

What are some best practices for preventing Returning a Mutable Object to an Untrusted Caller?

Some best practices include verifying return values, testing your code, and using allowlists.

How does PenScan’s AI-powered coding assistant help with Returning a Mutable Object to an Untrusted Caller?

You can use the copy-paste prompt provided by PenScan to review your code for potential vulnerabilities and rewrite it using the primary fix technique.

Vulnerabilities Related to Returning a Mutable Object to an Untrusted Caller

References

• MITRE: CWE-375
• NVD: CWE-375

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Returning a Mutable Object to an Untrusted Caller and other risks before an attacker does.