CWE-486: Comparison of Classes by Name
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
How it's found
Comparison of Classes by Name is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
If the decision to trust the methods and data of an object is based on the name of a class, it is possible for malicious users to send objects of the same name as trusted classes and thereby gain the trust afforded to known classes and types.
Vulnerable vs. safe
// Do something assuming you trust inputClass
// ...if (inputClass.getClass().getName().equals("TrustedClassName")) {}// Do something assuming you trust inputClass
// ...if (inputClass.getClass() == TrustedClass.class) {}Consequences
- Execute Unauthorized Code or Commands: If a product relies solely on the name of an object to determine identity, it may execute the incorrect or unintended code.
Mitigations
- Implementation: Use class equivalency to determine type. Rather than use the class name to determine if an object is of a given type, use the getClass() method, and == operator.
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-486?
The product compares classes by name, which can cause it to use the wrong class when multiple classes can have the same name.
How do you find Comparison of Classes by Name?
Comparison of Classes by Name is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-486?
Execute Unauthorized Code or Commands: If a product relies solely on the name of an object to determine identity, it may execute the incorrect or unintended code.
Does TurboPentest test for Comparison of Classes by Name?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest