CWE-500: Public Static Field Not Marked Final

How it's found

Public Static Field Not Marked Final is a specific, narrowly defined instance of a broader pattern. Testers confirm it with targeted code review and a proof-of-concept input that exercises the exact code path this weakness describes.

Public static variables can be read without an accessor and changed without a mutator by any classes in the application.

Vulnerable vs. safe

static string appPropertiesConfigFile = "app/properties.config";public:...class SomeAppClass {}

static const string appPropertiesConfigFile = "app/properties.config";public:...class SomeAppClass {}

Consequences

• Modify Application Data: The object could potentially be tampered with.
• Read Application Data: The object could potentially allow the object to be read.

Mitigations

• Architecture and Design: Clearly identify the scope for all critical data elements, including whether they should be regarded as static.
• Implementation: Make any static fields private and constant. A constant field is denoted by the keyword 'const' in C/C++ and ' final' in Java

Where this fits in a TurboPentest engagement

TurboPentest's agentic pentest is powerful and covers a broad range of issues automatically. This particular class is best confirmed in a manual IntegSec engagement, where human pentesters apply deeper methodology and a larger context window than any automated pass.

Frequently asked questions

Related CWEs

• Variant weakness
  CWE-493: Critical Public Variable Without Final Modifier