What is Use of Externally-Controlled Input (CWE-470)?

TL;DR: Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) (CWE-470) is a critical vulnerability where an application uses unvalidated external input to select classes or code via reflection, allowing attackers to execute unauthorized commands.

What is Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)?

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) (CWE-470) is a type of injection vulnerability that occurs when an application uses external input with reflection to select classes or code without proper validation. This can allow attackers to execute unauthorized code, alter execution logic, and cause denial-of-service conditions.

As defined by the MITRE Corporation under CWE-470, and classified by the OWASP Foundation under A05:2025 - Injection…

Quick Summary

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) is a critical vulnerability where an application uses unvalidated external input to select classes or code via reflection. This can lead to unauthorized code execution, logic alterations, and denial-of-service conditions.

Jump to: Quick Summary · Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Overview · How Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Works · Business Impact of Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Attack Scenario · How to Detect Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · How to Fix Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · Framework-Specific Fixes for Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · How to Ask AI to Check Your Code for Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Best Practices Checklist · Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) FAQ · Vulnerabilities Related to Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) · References · Scan Your Own Site

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Overview

What: A vulnerability where an application uses unvalidated external input with reflection to select classes or code.

Why it matters: This can allow attackers to execute unauthorized code, alter execution logic, and cause denial-of-service conditions by invoking unexpected methods.

Where it occurs: In applications that use reflection mechanisms without proper validation of user inputs.

Who is affected: Applications using Java, Python, Node.js, PHP, or other languages with reflection capabilities.

Who is NOT affected: Systems already employing strict input validation for class loading and method invocation.

How Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Works

Root Cause

The root cause lies in the lack of proper validation when using external inputs to select classes or invoke methods via reflection. This allows attackers to inject malicious code through user-controlled input.

Attack Flow

1. Attacker identifies a vulnerable application that uses reflection with unvalidated input.
2. The attacker crafts an input value that triggers the loading of a malicious class.
3. The application loads and executes the specified class, leading to unauthorized behavior.

Prerequisites to Exploit

• External inputs must be used in class or method selection via reflection.
• Lack of proper validation for these inputs.

Vulnerable Code

String className = request.getParameter("class");
Class<?> clazz = Class.forName(className);

This code directly uses user input (request.getParameter("class")) to load a class, bypassing any necessary validation.

Secure Code

String allowedClasses[] = {"com.safe.Class1", "com.safe.Class2"};
String className = request.getParameter("class");
if (!Arrays.asList(allowedClasses).contains(className)) {
    throw new IllegalArgumentException("Invalid class name.");
}
Class<?> clazz = Class.forName(className);

The secure version uses an allowlist to restrict the classes that can be loaded, ensuring only trusted inputs are accepted.

Business Impact of Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

Confidentiality: Attackers might read sensitive data by invoking methods with access to restricted information. Integrity: Attackers could alter system state or modify critical application logic through unexpected method calls. Availability: Unexpected code execution can cause the application to crash, leading to denial-of-service conditions.

• Financial loss due to downtime and recovery efforts
• Compliance penalties for security breaches
• Reputation damage from publicized vulnerabilities

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Attack Scenario

1. Attacker identifies a web application that uses reflection with unvalidated input.
2. The attacker crafts an HTTP request with a malicious class name as part of the query parameters.
3. The application loads and executes the specified class, leading to unauthorized code execution.

How to Detect Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

Manual Testing

• Check for instances where external inputs are used in reflection calls without proper validation.

• Look for patterns such as Class.forName(userInput).

  • Search for Class.forName() and similar methods with user input parameters.
  • Verify that any use of reflection is properly validated.

Automated Scanners (SAST / DAST)

Static analysis can detect direct usage of unvalidated inputs in reflection calls. Dynamic testing requires runtime observation to confirm actual exploitation.

PenScan Detection

PenScan’s scanner engines such as ZAP, Nuclei, Wapiti, Nikto, SSLyze, Dalfox, and Nmap are capable of identifying Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerabilities during automated scans.

False Positive Guidance

A false positive may occur if the input is validated elsewhere in the code but not at the point where reflection occurs. Ensure that any validation logic is present and effective before a method call using reflection.

How to Fix Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

• Refactor your code to avoid using reflection with user input.
• Do not use user-controlled inputs to select and load classes or code.
• Apply strict input validation by using allowlists or indirect selection to ensure that the user is only selecting allowable classes or code.

Framework-Specific Fixes for Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

Java

String allowedClasses[] = {"com.safe.Class1", "com.safe.Class2"};
String className = request.getParameter("class");
if (!Arrays.asList(allowedClasses).contains(className)) {
    throw new IllegalArgumentException("Invalid class name.");
}
Class<?> clazz = Class.forName(className);

This example uses an allowlist to restrict the classes that can be loaded, ensuring only trusted inputs are accepted.

Python

import sys

def load_class(class_name):
    allowed_classes = ['safe_module.Class1', 'safe_module.Class2']
    if class_name not in allowed_classes:
        raise ValueError("Invalid class name.")
    return __import__(class_name)

load_class(request.form['class'])

Node.js

const allowedClasses = ['safeModule.Class1', 'safeModule.Class2'];
const className = req.query.class;

if (!allowedClasses.includes(className)) {
    throw new Error('Invalid class name.');
}

require(className);

PHP

$allowed_classes = array("Safe\\Class1", "Safe\\Class2");
$class_name = $_GET['class'];

if (!in_array($class_name, $allowed_classes)) {
    die('Invalid class name');
}
spl_autoload_call($class_name);

How to Ask AI to Check Your Code for Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

Review the following [language] code block for potential CWE-470 Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerabilities and rewrite it using allowlist validation:

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) Best Practices Checklist

✅ Refactor your code to avoid using reflection with user input. ✅ Do not use user-controlled inputs to select and load classes or code. ✅ Apply strict input validation by using allowlists or indirect selection.

Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) FAQ

How does Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) work?

It occurs when an application uses external input with reflection to select classes or code without proper validation, allowing attackers to execute unauthorized code.

What are the consequences of a Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability?

Attackers can alter execution logic, read sensitive data, and cause denial-of-service conditions by invoking unexpected classes or methods.

Can you provide an example of vulnerable code for Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)?

An example is using user input directly in a reflection call without validation, such as Class.forName(request.getParameter("class")).

How can I detect Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerabilities?

Look for instances where external inputs are used to load classes or invoke methods via reflection without proper sanitization.

What is the best way to fix a Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability?

Refactor code to avoid using reflection with user input and implement strict validation for any inputs used in class loading.

How can I prevent Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerabilities in my application?

Avoid allowing external inputs to control which classes or methods are loaded via reflection, and use allowlists to restrict valid input values.

What is the impact of a Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) vulnerability on system availability?

It can cause denial-of-service conditions by invoking unexpected code that crashes or hangs the application.

Vulnerabilities Related to Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’)

References

• MITRE: CWE-470
• OWASP Top 10 A05:2025 - Injection
• CAPEC-138
• NVD

Scan Your Own Site

Manual code review catches what you know to look for. An automated scan catches what you didn’t. Scan your own website using PenScan to find Use of Externally-Controlled Input to Select Classes or Code (‘Unsafe Reflection’) and other risks before an attacker does.