What is Serializable Class Containing Sensitive (CWE-499)?

TL;DR: Serializable Class Containing Sensitive Data (CWE-499) is a vulnerability where sensitive data can be accessed through improper serialization, compromising confidentiality and integrity. Prevent it by explicitly denying serialization.

What is Serializable Class Containing Sensitive Data?

Serializable Class Containing Sensitive Data (CWE-499) is a type of vulnerability where classes with sensitive data can be serialized and accessed by attackers. As defined by the MITRE Corporation under CWE-499, this issue occurs when sensitive data in a class is not explicitly denied serialization.

Quick Summary

Serializable Class Containing Sensitive Data allows unauthorized access to sensitive information through improper serialization mechanisms. This vulnerability compromises confidentiality and integrity, leading to potential financial loss, compliance issues, and reputational damage if sensitive data is leaked or misused. Jump to: Overview · How It Works · Business Impact · Attack Scenario · Detection · Fixing · Framework-Specific Fixes · Asking AI · Best Practices Checklist · FAQ · Related Vulnerabilities

Jump to: Quick Summary · Serializable Class Containing Sensitive Data Overview · How Serializable Class Containing Sensitive Data Works · Business Impact of Serializable Class Containing Sensitive Data · Serializable Class Containing Sensitive Data Attack Scenario · How to Detect Serializable Class Containing Sensitive Data · How to Fix Serializable Class Containing Sensitive Data · Framework-Specific Fixes for Serializable Class Containing Sensitive Data · How to Ask AI to Check Your Code for Serializable Class Containing Sensitive Data · Serializable Class Containing Sensitive Data Best Practices Checklist · Serializable Class Containing Sensitive Data FAQ · Vulnerabilities Related to Serializable Class Containing Sensitive Data · References · Scan Your Own Site

Serializable Class Containing Sensitive Data Overview

What: A vulnerability where classes with sensitive data can be serialized and accessed by attackers. Why it matters: Unauthorized access to sensitive information compromises confidentiality and integrity, leading to severe consequences. Where it occurs: In applications that serialize objects containing sensitive data without proper safeguards. Who is affected: Developers and organizations using languages like Java, Node.js, Python/Django, PHP, etc., where serialization can be exploited. Who is NOT affected: Systems already implementing robust security measures to prevent object serialization of sensitive data.

How Serializable Class Containing Sensitive Data Works

Root Cause

The root cause lies in the lack of explicit denial of serialization for classes containing sensitive data. This allows attackers to serialize and access sensitive information through another class.

Attack Flow

1. An attacker identifies a class with sensitive data that does not explicitly deny serialization.
2. The attacker serializes the class, writing it out to a byte stream.
3. The attacker extracts important data from the serialized object.
4. Sensitive information is compromised.

Prerequisites to Exploit

• A class containing sensitive data must be found without explicit denial of serialization.
• Serialization mechanisms must allow access to the sensitive data.

Vulnerable Code

public class SensitiveData {
    private String secret;

    public SensitiveData(String secret) {
        this.secret = secret;
    }

    // No writeObject() method defined
}

This code does not prevent serialization of the SensitiveData object, making it vulnerable.

Secure Code

public class SensitiveData {
    private String secret;

    public SensitiveData(String secret) {
        this.secret = secret;
    }

    protected void writeObject(ObjectOutputStream out) throws IOException {
        throw new NotSerializableException("Serialization of sensitive data is not allowed.");
    }
}

By explicitly denying serialization, the secure code prevents unauthorized access to sensitive information.

Business Impact of Serializable Class Containing Sensitive Data

Confidentiality: Exposed sensitive data can lead to financial loss and compliance issues.

• Example: An attacker extracts confidential user credentials from serialized objects.
• Consequences: Financial penalties for violating privacy laws, damage to reputation.

Serializable Class Containing Sensitive Data Attack Scenario

1. The attacker identifies a class with sensitive data that does not deny serialization.
2. The attacker serializes the object and writes it out to a byte stream.
3. The attacker extracts important information from the serialized object.
4. Confidentiality is compromised, leading to potential financial loss and reputational damage.

How to Detect Serializable Class Containing Sensitive Data

Manual Testing

• Identify classes containing sensitive data.
• Check if these classes explicitly deny serialization through methods like writeObject().
• Verify that no serialization mechanisms allow access to sensitive information.

Automated Scanners (SAST / DAST)

Static analysis can detect classes with sensitive data that do not have proper safeguards against serialization. Dynamic testing is necessary to confirm actual exploitation of the vulnerability in a runtime environment.

PenScan Detection

PenScan’s automated scanners use static analysis techniques to identify classes containing sensitive data without explicit denial of serialization.

False Positive Guidance

False positives may occur if the class contains sensitive data but has other mechanisms preventing unauthorized access. Confirm that no such protections are in place before flagging as a vulnerability.

How to Fix Serializable Class Containing Sensitive Data

• Explicitly define final writeObject() methods to throw exceptions, preventing serialization of classes containing sensitive data.
• Ensure proper security measures are implemented to prevent unauthorized access to serialized objects.
• Review and update existing code to include explicit denial of serialization for sensitive data.

Framework-Specific Fixes for Serializable Class Containing Sensitive Data

Java

public class SensitiveData {
    private String secret;

    public SensitiveData(String secret) {
        this.secret = secret;
    }

    protected void writeObject(ObjectOutputStream out) throws IOException {
        throw new NotSerializableException("Serialization of sensitive data is not allowed.");
    }
}

By explicitly denying serialization, the secure code prevents unauthorized access to sensitive information.

Node.js

class SensitiveData {
  constructor(secret) {
    this.secret = secret;
  }

  static serialize() {
    throw new Error('Serialization of sensitive data is not allowed.');
  }
}

Python/Django

class SensitiveData:
    def __init__(self, secret):
        self.secret = secret

    def __getstate__(self):
        raise TypeError("Serialization of sensitive data is not allowed.")

PHP

class SensitiveData {
    private $secret;

    public function __construct($secret) {
        $this->secret = $secret;
    }

    public function __sleep() {
        throw new Exception('Serialization of sensitive data is not allowed.');
    }
}

How to Ask AI to Check Your Code for Serializable Class Containing Sensitive Data

Serializable Class Containing Sensitive Data Best Practices Checklist

✅ Explicitly deny serialization of classes containing sensitive data. ✅ Implement robust security measures to prevent unauthorized access to serialized objects. ✅ Regularly review and update existing code for proper denial of serialization. ✅ Use static analysis tools to identify potential vulnerabilities in serialization mechanisms. ✅ Test your application thoroughly to ensure no sensitive information is exposed through serialization.

Serializable Class Containing Sensitive Data FAQ

How does Serializable Class Containing Sensitive Data work?

The code contains a class with sensitive data that can be accessed by serializing the class through another class, allowing an attacker to extract important data from it.

Why is serialization of sensitive data risky?

Serialization allows attackers to write out the class to a byte stream and then extract sensitive information, compromising confidentiality and integrity.

How can you detect Serializable Class Containing Sensitive Data in code?

Use static analysis tools to identify classes with sensitive data that do not explicitly deny serialization through methods like writeObject().

What is the best way to prevent Serializable Class Containing Sensitive Data vulnerabilities?

Explicitly define final writeObject() methods to throw exceptions, preventing serialization of sensitive objects.

How can you fix Serializable Class Containing Sensitive Data in Java?

In Java, override writeObject() and throw an exception to prevent serialization of classes containing sensitive data.

What are the business impacts of Serializable Class Containing Sensitive Data vulnerabilities?

Exposed sensitive data can lead to financial loss, compliance issues, and damage to reputation if leaked or misused.

How does PenScan detect Serializable Class Containing Sensitive Data?

PenScan’s automated scanners use static analysis techniques to identify classes with sensitive data that are not properly secured against serialization.

Vulnerabilities Related to Serializable Class Containing Sensitive Data

| CWE | Name | Relationship | |—|—|—| | CWE-668 | Exposure of Resource to Wrong Sphere (ChildOf) | ChildOf | | CWE-200 | Exposure of Sensitive Information to an Unauthorized Actor (CanPrecede) | CanPrecede |

References

• MITRE
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Serializable Class Containing Sensitive Data and other risks before an attacker does.