CWE-495: Private Data Structure Returned From A Public Method

What is Private Data Structure Returned From A Public Method?

• Overview: Private Data Structure Returned From A Public Method (CWE-495) occurs when a public method returns a reference to a private data structure, allowing external code to modify that data in unpredictable or insecure ways, potentially leading to data corruption or unauthorized access.

• Exploitation Methods:

• Attackers can exploit this vulnerability by calling the public method and obtaining a reference to the private data, then modifying this data directly.
• Common attack patterns include altering the data structure contents to bypass validation checks or injecting malicious data to disrupt expected application behavior.

• Security Impact:

• Direct consequences of successful exploitation include data integrity issues, unauthorized data manipulation, and potential exposure of sensitive information.
• Potential cascading effects involve system instability, erroneous application behavior, and violation of data confidentiality constraints.
• Business impact might include loss of customer trust, regulatory non-compliance penalties, and potential financial loss due to data breaches or service disruptions.

• Prevention Guidelines:

• Specific code-level fixes include returning a copy of the private data structure instead of the original reference, ensuring that external code cannot modify the original data.
• Security best practices involve encapsulating data structures properly, using accessors or immutable objects to control data exposure, and adhering to the principle of least privilege.
• Recommended tools and frameworks include static analysis tools to detect improper data exposure patterns and secure coding libraries that enforce encapsulation and data integrity automatically.

Corgea can automatically detect and fix Private Data Structure Returned From A Public Method in your codebase. [Try Corgea free today](https://corgea.app).

Technical Details

Likelihood of Exploit: Not specified

Affected Languages: C, C++, Java, C#

Affected Technologies: Not specified

Vulnerable Code Example

#include <stdio.h>

typedef struct {
    int secretValue;
} PrivateData;

// This function is vulnerable because it returns a pointer to a private data structure
PrivateData* getPrivateData() { 
    static PrivateData data = {42}; // The static keyword makes this data persist across function calls
    return &data; // Returning a pointer allows external modification of the private data
}

int main() {
    PrivateData* data = getPrivateData();
    printf("Secret Value: %d\n", data->secretValue);
    data->secretValue = 99; // The private data can be modified externally, violating encapsulation
    printf("Modified Secret Value: %d\n", data->secretValue);
    return 0;
}

Explanation

In this code, the function getPrivateData() returns a pointer to a static PrivateData structure. This exposes the internal state of the structure, allowing external code to modify it. This can lead to unintended side effects and security vulnerabilities, as the private data can be altered by any part of the program that has access to the pointer.

How to fix Private Data Structure Returned From A Public Method?

To fix this vulnerability, avoid returning pointers or references to internal data structures. Instead, provide a copy of the data or use getter functions to return specific values. This approach ensures that the internal state remains encapsulated and cannot be directly modified by external code.

Fixed Code Example

#include <stdio.h>

typedef struct {
    int secretValue;
} PrivateData;

// Instead of returning a pointer, return a copy of the private data
PrivateData getPrivateData() {
    PrivateData data = {42}; // Create a new instance of PrivateData
    return data; // Return a copy of the data to ensure encapsulation
}

int main() {
    PrivateData data = getPrivateData(); // Receive a copy of the data
    printf("Secret Value: %d\n", data.secretValue);
    // Modification attempts will only affect the local copy, not the original data
    data.secretValue = 99;
    printf("Modified Secret Value: %d\n", data.secretValue);
    return 0;
}

Explanation

In the fixed code, getPrivateData() returns a copy of the PrivateData structure instead of a pointer. This prevents external code from modifying the private data directly. Any changes made to data in the main() function affect only the local copy, preserving the integrity of the original data. This encapsulation practice is crucial in maintaining data security and integrity. By returning a copy, we ensure that the internal state of the PrivateData structure remains protected from unintended modifications.