CWE-486: Comparison of Classes by Name

What is Comparison of Classes by Name?

• Overview: Comparing classes by name can lead to security vulnerabilities because classes with the same name might be mistaken for each other, allowing potentially malicious classes to be trusted incorrectly.

• Exploitation Methods:

• Attackers can craft malicious classes with the same name as trusted classes to bypass security checks.
• Common attack patterns include injecting or substituting classes during runtime or using reflection to manipulate class usage.

• Security Impact:

• Direct consequences include unauthorized access to methods and data of trusted classes.
• Potential cascading effects involve privilege escalation or execution of unintended code paths.
• Business impact can include data breaches, loss of intellectual property, and damage to reputation.

• Prevention Guidelines:

• Specific code-level fixes include verifying classes using fully qualified class names (including the package name) instead of simple class names.
• Security best practices involve using strong access control mechanisms and validating objects and classes through digital signatures or trusted certificates.
• Recommended tools and frameworks include using static analysis tools to detect such issues and adopting frameworks that enforce strict type and class checks, such as using dependency injection frameworks that manage class instances securely.

Corgea can automatically detect and fix Comparison of Classes by Name in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: High

Affected Languages: Java

Affected Technologies: Not specified

Vulnerable Code Example

Java Example

public class ClassComparator {

    // Vulnerable method that compares class names as Strings
    public boolean areClassesEqualByName(Object obj1, Object obj2) {
        // This comparison is vulnerable because it relies on class names as Strings
        return obj1.getClass().getName().equals(obj2.getClass().getName());
    }
}

Explanation:

• Vulnerability: The method areClassesEqualByName uses string comparison of class names, which is insecure. Different classes can share the same name if they reside in different packages. This can lead to incorrect assumptions about object types, potentially causing security issues if class identity is crucial for the logic.

How to fix Comparison of Classes by Name?

• Best Practice: Use the Class object itself for comparison to ensure that the class identity, including its package, is considered. This provides a more accurate and secure representation of the class.
• Security Principle: Verifying identity through intrinsic properties rather than external representations like names mitigates risks related to namespace collisions or malicious attempts to spoof class identity.

Fixed Code Example

public class ClassComparator {

    // Fixed method that compares class instances directly
    public boolean areClassesEqualByClass(Object obj1, Object obj2) {
        // This comparison is secure because it uses the Class object itself
        return obj1.getClass().equals(obj2.getClass());
    }
}

Explanation:

• Fix: The method now uses obj1.getClass().equals(obj2.getClass()) to compare the Class objects directly. This ensures that both the class name and the package are considered, avoiding the vulnerability of namespace collisions.
• Outcome: By comparing the Class objects directly, the code is now secure against potential class name collisions and ensures that the logic correctly determines class equality.

Additional Notes:

• Best Practices: Always ensure that class comparisons are done using intrinsic properties like the Class object, rather than relying on potentially misleading external representations such as class names.
• Code Consistency: Ensure consistent formatting and syntax highlighting for better readability and understanding.