CWE-608 applies to Java applications built on Apache Struts. An ActionForm class contains a field that has not been declared private, so it can be accessed without a setter or getter.
How it happens
Struts binds request parameters to ActionForm fields. The intended path goes through accessor methods. A field left as public or package-visible opens a second path that skips them.
// Vulnerable pattern
public class AccountForm extends ActionForm {
public String role; // reachable without getter or setter
private String name;
public String getName() { return name; }
public void setName(String n) { name = n; }
}
Any code in the application can then read or assign role directly, and any validation placed in the accessors is skipped.
What an attacker gains
The record lists integrity and confidentiality: application data can be modified or read.
How to find it
Static analysis (SAST) can find some instances. A direct search of classes that extend ActionForm for any field not marked private finds them quickly.
How to fix it
MITRE's guidance:
- Make all fields private.
- Use the getter to get the value of the field.
- The setter should be used only by the framework. Setting an action form field from other actions is bad practice and should be avoided.
public class AccountForm extends ActionForm {
private String role;
private String name;
public String getName() { return name; }
public void setName(String n) { name = n; }
}
Quick check
Who should call an ActionForm setter?
Only the framework. Other actions should not set form fields.
