CWE-374: Passing Mutable Objects to an Untrusted Method
The product sends non-cloned mutable data as an argument to a method or function.
How it's found
Passing Mutable Objects to an Untrusted Method is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
The function or method that has been called can alter or delete the mutable data. This could violate assumptions that the calling function has made about its state. In situations where unknown code is called with references to mutable data, this external code could make changes to the data sent. If this data was not previously cloned, the modified data might not be valid in the context of execution.
Vulnerable vs. safe
// constructor for BookStore
// other BookStore methods
this.inventory = new BookStoreInventory();this.sales = new SalesDBManager();...
// Get book object from inventory using ISBN
// update sales information for book sold
// update inventoryBook book = inventory.getBookWithISBN(bookISBN);sales.updateSalesInformation(book);inventory.updateInventory(book);private BookStoreInventory inventory;private SalesDBManager sales;...public BookStore() {}public void updateSalesAndInventoryForBookSold(String bookISBN) {}...
// Book object constructors and get/set methodsprivate String title;private String author;private String isbn;...
public class BookStore {}public class Book {}// Get book object from inventory using ISBN
// Create copy of book object to make sure contents are not changed
// update sales information for book sold
// update inventoryBook book = inventory.getBookWithISBN(bookISBN);Book bookSold = (Book) book.clone();sales.updateSalesInformation(bookSold);inventory.updateInventory(book);...public void updateSalesAndInventoryForBookSold(String bookISBN) {}...Consequences
- Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Mitigations
- Implementation: Pass in data which should not be altered as constant or immutable.
- Implementation: Clone all mutable data before passing it into an external function . This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-374?
The product sends non-cloned mutable data as an argument to a method or function.
How do you find Passing Mutable Objects to an Untrusted Method?
Passing Mutable Objects to an Untrusted Method is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-374?
Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Does TurboPentest test for Passing Mutable Objects to an Untrusted Method?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest