CWE-498: Cloneable Class Containing Sensitive Information
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
How it's found
Cloneable Class Containing Sensitive Information is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that do not explicitly deny cloning can be cloned by any other class without running the constructor.
Vulnerable vs. safe
Teacher t1 = new Teacher("guddu","22,nagar road");//...// Do some stuff to remove the teacher.Teacher t2 = (Teacher)t1.clone();System.out.println(t2.name);
new CloneClient();public CloneClient() //throwsjava.lang.CloneNotSupportedException {}public static void main(String args[]) {}
return super.clone();
throw new RuntimeException(e.toString());try {}catch (java.lang.CloneNotSupportedException e) {}
this.name = name;this.clas = clas;public Object clone() {}public String name;public String clas;public Teacher(String name,String clas) {}
public class CloneClient {}class Teacher implements Cloneable {}throw new java.lang.CloneNotSupportedException();public final void clone() throws java.lang.CloneNotSupportedException {}Consequences
- Bypass Protection Mechanism: A class that can be cloned can be produced without executing the constructor. This is dangerous since the constructor may perform security-related checks. By allowing the object to be cloned, those checks may be bypassed.
Mitigations
- Implementation: If you do make your classes clonable, ensure that your clone method is final and throw super.clone().
Where this fits in a TurboPentest engagement
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Frequently asked questions
What is CWE-498?
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
How do you find Cloneable Class Containing Sensitive Information?
Cloneable Class Containing Sensitive Information is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-498?
Bypass Protection Mechanism: A class that can be cloned can be produced without executing the constructor. This is dangerous since the constructor may perform security-related checks. By allowing the object to be cloned, those checks may be bypassed.
Does TurboPentest test for Cloneable Class Containing Sensitive Information?
TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.
Related CWEs
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a $99 pentest