CWE-9 applies when elevated access rights are assigned to enterprise bean methods, so an attacker can use those permissions against the product. The telltale sign is in the deployment descriptor: a method permission that grants access to the special ANYONE role.
MITRE reads that as a signal. Either access control was not fully thought through, or the application is structured in a way that makes reasonable restrictions impossible. Both are design problems, not typos.
How it happens
Enterprise bean methods are protected by role based permissions declared in the descriptor. Granting a method to ANYONE removes the check entirely. Teams do this to get past an authorization error during development and then ship it. Or a method that was meant to be internal ends up in a broad permission block because it shares a bean with public methods.
What an attacker gains
The MITRE record lists the consequence as other. That vagueness is honest: what an attacker gets depends on what the method does. A method that reads records leaks them. A method that changes state lets the attacker change it. The permission itself is the opening.
How to find it
Search every descriptor for the ANYONE role and list each method it covers. Then ask of each one whether an unauthenticated or low privilege caller should really be able to run it. Also look for methods with no permission entry at all, since their behavior depends on the container's defaults.
How to fix it
- Replace broad grants with named roles that match real job functions.
- Split beans so public and internal methods are not mixed.
- Deny by default, then add permissions deliberately.
- Review the descriptor whenever a bean gains a new method.
Quick check
Is ANYONE always wrong?
Not always, since some methods are meant to be public. But each use should be a recorded decision, not a leftover from debugging.
