CWE-493, Critical Public Variable Without Final Modifier, describes a critical public variable that is not final, so it can be changed to hold unexpected values. MITRE lists object oriented languages, Java and C++.
How it happens
MITRE explains that a non final public field can be changed, after its value is set, by any function that has access to the class. That becomes a vulnerability when other parts of the program assume the field holds what it was first given.
// Vulnerable: any caller can overwrite the allowed host
public class Settings {
public static String allowedHost = "api.internal";
}
// elsewhere, hostile or buggy code:
Settings.allowedHost = "evil.example";
Code that later checks Settings.allowedHost now trusts the attacker's value.
What an attacker gains
MITRE lists two impacts. The object could be tampered with, affecting integrity, and it could be read, affecting confidentiality. The record has no observed CVEs.
How to find it
Static analysis can find some instances. A search for public non final fields in classes that hold configuration, keys or state also works well.
How to fix it
MITRE's guidance: declare all public fields final when possible, especially when they keep internal state of an Applet or of classes an Applet uses. If a field must be public, run all appropriate sanity checks before your code uses it.
public final class Settings {
public static final String ALLOWED_HOST = "api.internal";
}
Where the value must change, make the field private and expose a method that validates every update.
Quick check
If the field must stay mutable, what is the safe alternative?
Make it private, and change it only through a method that checks the new value. Then validate again before use if the value matters to security.
