CWE-375: Returning a Mutable Object to an Untrusted Caller
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
How it's found
Returning a Mutable Object to an Untrusted Caller is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
In situations where functions return references to mutable data, it is possible that the external code which called the function may make changes to the data sent. If this data was not previously cloned, the class will then be using modified data which may violate assumptions about its internal state.
Consequences
- Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Mitigations
- Implementation: Declare returned data which should not be altered as constant or immutable.
- Implementation: Clone all mutable data before returning references to it. This is the preferred mitigation. This way, regardless of what changes are made to the data, a valid copy is retained for use by the class.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-375?
Sending non-cloned mutable data as a return value may result in that data being altered or deleted by the calling function.
How do you find Returning a Mutable Object to an Untrusted Caller?
Returning a Mutable Object to an Untrusted Caller is typically found by tracing untrusted input from where it enters the system to the point where it is used without the check or neutralization this weakness describes, combining manual code review with dynamic testing.
What is the impact of CWE-375?
Modify Memory: Potentially data could be tampered with by another function which should not have been tampered with.
Does TurboPentest test for Returning a Mutable Object to an Untrusted Caller?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest