CWE-499 covers a class that contains sensitive data but does not explicitly deny serialization. MITRE lists Java as the affected language. Private fields feel hidden, but serialization turns them into bytes that anyone can read.
How it happens
Serializable classes are effectively open classes. Another class can serialize an instance and use whatever data is stored inside it. A class might become serializable on purpose, or by inheriting from a parent that implements Serializable, so the exposure is easy to miss.
// Vulnerable: a secret in a serializable class
public class Session implements java.io.Serializable {
private String userId;
private String authToken; // written out with the rest
}
What an attacker gains
MITRE describes the consequence as a loss of confidentiality. An attacker writes the object out to a byte stream, then extracts the important data from it.
How to find it
Static analysis can find some instances. Manually, list classes that implement Serializable, directly or through a parent, and check which of them have fields holding keys, tokens or personal data.
How to fix it
MITRE's recommended fix for Java is to define a final writeObject() that throws an exception, which explicitly denies serialization.
private final void writeObject(java.io.ObjectOutputStream out)
throws java.io.IOException {
throw new java.io.IOException("Class cannot be serialized");
}
If the class must be serializable, mark the sensitive fields transient so they are left out of the stream.
Quick check
Does a private field protect data from serialization?
No. Serialization writes private fields too. Use transient or deny serialization.
