CWE-578 is an EJB rule violation: a bean uses the class loader.
The specification forbids a bean from creating a class loader, getting the current class loader, setting the context class loader, setting or creating a security manager, stopping the JVM, or changing the input, output and error streams. MITRE quotes the reason: these functions are reserved for the container, and letting a bean use them could compromise security and reduce the container's ability to manage the runtime.
Unlike its sibling EJB rules, MITRE lists real security consequences here: confidentiality, integrity and availability impact, including execution of unauthorized code or commands, varying by context.
How it happens
MITRE's example is a mortgage rate bean that uses the bean class's class loader to open an XML file from the local file system:
// Vulnerable
@Stateless
public class InterestRateBean implements InterestRateRemote {
public InterestRateBean() {
ClassLoader loader = this.getClass().getClassLoader();
InputStream in = loader.getResourceAsStream("rates.xml");
...
}
}
Code that manipulates class loaders can load classes the container never vetted, or change which classes other code sees.
What an attacker gains
If an attacker can influence what the bean loads, such as a class name or resource path, they may get their own code running inside the container. That is why MITRE includes code execution among the consequences.
How to find it
Search bean classes for getClassLoader, setContextClassLoader, ClassLoader, System.exit, System.setSecurityManager and System.setOut. The record lists no detection methods.
How to fix it
MITRE's mitigation: do not use the class loader when writing EJBs. Get resources through container managed injection or a resource manager, and never pass untrusted names into loading code.
@Stateless
public class InterestRateBean implements InterestRateRemote {
@PersistenceContext EntityManager em;
public BigDecimal rateFor(int points) {
return em.find(Rate.class, points).getValue();
}
}
Quick check
Why is this more serious than the other EJB rules?
Class loader control can lead to unauthorized code execution, and MITRE lists confidentiality, integrity and availability impact.
The free in-browser scan at gold.safeguard.sh/scan lists the dependencies in your manifest. No login is needed, the file stays on your machine, and it handles up to 100 dependencies.
