CWE-374: Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function.
How it's found
Passing Mutable Objects to an Untrusted Method is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
The function or method that has been called can alter or delete the mutable data. This could violate assumptions that the calling function has made about its state. In situations where unknown code is called with references to mutable data, this external code could make changes to the data sent. If this data was not previously cloned, the modified data might not be valid in the context of execution.
Vulnerable vs. safe
// constructor for BookStore
// other BookStore methods
this.inventory = new BookStoreInventory();this.sales = new SalesDBManager();...
// Get book object from inventory using ISBN
// update sales information for book sold
// update inventoryBook book = inventory.getBookWithISBN(bookISBN);sales.updateSalesInformation(book);inventory.updateInventory(book);private BookStoreInventory inventory;private SalesDBManager sales;...public BookStore() {}public void updateSalesAndInventoryForBookSold(String bookISBN) {}...
// Book object constructors and get/set methodsprivate String title;private String author;private String isbn;...
public class BookStore {}public class Book {}// Get book object from inventory using ISBN
// Create copy of book object to make sure contents are not changed
// update sales information for book sold
// update inventoryBook book = inventory.getBookWithISBN(bookISBN);Book bookSold = (Book) book.clone();sales.updateSalesInformation(bookSold);inventory.updateInventory(book);...public void updateSalesAndInventoryForBookSold(String bookISBN) {}...Consequences
- Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Mitigations
- Implementation: Pass in data which should not be altered as constant or immutable.
- Implementation: Clone all mutable data before passing it into an external function . This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-374?
The product sends non-cloned mutable data as an argument to a method or function.
How do you find Passing Mutable Objects to an Untrusted Method?
Passing Mutable Objects to an Untrusted Method is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-374?
Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Does TurboPentest test for Passing Mutable Objects to an Untrusted Method?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest