CWE-498: Cloneable Class Containing Sensitive Information
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
How it's found
Cloneable Class Containing Sensitive Information is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
Cloneable classes are effectively open classes, since data cannot be hidden in them. Classes that do not explicitly deny cloning can be cloned by any other class without running the constructor.
Vulnerable vs. safe
Teacher t1 = new Teacher("guddu","22,nagar road");//...// Do some stuff to remove the teacher.Teacher t2 = (Teacher)t1.clone();System.out.println(t2.name);
new CloneClient();public CloneClient() //throwsjava.lang.CloneNotSupportedException {}public static void main(String args[]) {}
return super.clone();
throw new RuntimeException(e.toString());try {}catch (java.lang.CloneNotSupportedException e) {}
this.name = name;this.clas = clas;public Object clone() {}public String name;public String clas;public Teacher(String name,String clas) {}
public class CloneClient {}class Teacher implements Cloneable {}throw new java.lang.CloneNotSupportedException();public final void clone() throws java.lang.CloneNotSupportedException {}Consequences
- Bypass Protection Mechanism: A class that can be cloned can be produced without executing the constructor. This is dangerous since the constructor may perform security-related checks. By allowing the object to be cloned, those checks may be bypassed.
Mitigations
- Implementation: If you do make your classes clonable, ensure that your clone method is final and throw super.clone().
Where this fits in a TurboPentest engagement
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Frequently asked questions
What is CWE-498?
The code contains a class with sensitive data, but the class is cloneable. The data can then be accessed by cloning the class.
How do you find Cloneable Class Containing Sensitive Information?
Cloneable Class Containing Sensitive Information is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.
What is the impact of CWE-498?
Bypass Protection Mechanism: A class that can be cloned can be produced without executing the constructor. This is dangerous since the constructor may perform security-related checks. By allowing the object to be cloned, those checks may be bypassed.
Does TurboPentest test for Cloneable Class Containing Sensitive Information?
This weakness is not covered by the automated black-box pentest. IntegSec pentesters cover it in a manual engagement.
Related CWEs
Written and reviewed by
Michel Chamberland - Founder & CEO, IntegSec
CISSP, OSCP, OSCE, CEH, GIAC, CCSK · 20+ years in offensive security
Michel has spent 20+ years on offensive security teams including IBM X-Force Red and Trustwave SpiderLabs, leading penetration tests, red team engagements, and breach response for Fortune 500 customers. He is the founder of IntegSec and the architect of TurboPentest.
Find these issues before an attacker does
TurboPentest runs an agentic AI pentest against your target and reports findings with proof, from $99 per target.
Start a pentest