CWE-486: Comparison of Classes by Name
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
How it's found
Comparison of Classes by Name is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
If the decision to trust the methods and data of an object is based on the name of a class, it is possible for malicious users to send objects of the same name as trusted classes and thereby gain the trust afforded to known classes and types.
Vulnerable vs. safe
// Do something assuming you trust inputClass
// ...if (inputClass.getClass().getName().equals("TrustedClassName")) {}// Do something assuming you trust inputClass
// ...if (inputClass.getClass() == TrustedClass.class) {}Consequences
- Execute Unauthorized Code or Commands: If a product relies solely on the name of an object to determine identity, it may execute the incorrect or unintended code.
Mitigations
- Implementation: Use class equivalency to determine type. Rather than use the class name to determine if an object is of a given type, use the getClass() method, and == operator.
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-486?
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
How do you find Comparison of Classes by Name?
Comparison of Classes by Name is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-486?
Execute Unauthorized Code or Commands: If a product relies solely on the name of an object to determine identity, it may execute the incorrect or unintended code.
Does TurboPentest test for Comparison of Classes by Name?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest