CWE-607 is a Java weakness. A public or protected static final field references a mutable object, which allows the object to be changed by malicious code, or accidentally from another package.
How it happens
Many developers read final as "cannot change". It means the reference cannot be reassigned. The object it points to can still be modified.
// Vulnerable pattern
public class Config {
public static final String[] ALLOWED_HOSTS = { "a.example.com", "b.example.com" };
}
// Anywhere else in the process
Config.ALLOWED_HOSTS[0] = "evil.example.com";
The same applies to lists, maps, and date objects held in such a field.
What an attacker gains
MITRE lists an integrity impact: application data can be modified. If the field backs a security decision such as an allowed host list or a set of permitted roles, tampering with it changes the application's behaviour for every user in the process.
How to find it
Static analysis (SAST) can find some instances. A simple search for public static final followed by an array type, List, Map, or Date finds most candidates.
How to fix it
MITRE's mitigation: protect mutable objects by making them private, and restrict access to the getter and setter as well.
public class Config {
private static final List<String> ALLOWED_HOSTS =
List.of("a.example.com", "b.example.com"); // immutable
public static List<String> allowedHosts() { return ALLOWED_HOSTS; }
}
If the object has to be mutable internally, return a copy or an unmodifiable view instead of the field itself.
Quick check
Does final prevent changing the contents of an array?
No. It only prevents the field from pointing at a different array.
