Fallos del tipo CWE-470

94 resultados

Reflexão insegura com entrada externa

É quando o código usa entrada do usuário (parâmetros HTTP, arquivos, etc.) para carregar classes, invocar métodos ou acessar membros via reflexão sem validação. Um atacante pode forçar o carregamento de classes maliciosas ou métodos sensíveis que não deveriam ser acessados.

Ejemplo

Um framework web aceita `?class=MinhaClasse&method=processar` e faz `Class.forName(userInput).getMethod(userMethod).invoke(obj)`. Se não validar, o atacante passa `java.lang.Runtime` e invoca `exec()` para executar comandos do sistema.

Cómo mitigar

Mantenha uma lista branca (whitelist) explícita de classes e métodos permitidos. Nunca use entrada do usuário diretamente em operações de reflexão; sempre valide contra essa lista antes de chamar `Class.forName()`, `getMethod()` ou similares.

CVE-2021-21985CRITICALThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plEPSS 100.0%KEVCVE-2024-4990HIGHUnsafe Reflection in base Component class in yiisoft/yii2EPSS 80.2%CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2025-3600HIGHUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXEPSS 24.1%CVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 14.8%CVE-2022-23744—Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bEPSS 4.6%CVE-2022-41853HIGHRemote code execution in HyperSQL DataBaseEPSS 3.9%CVE-2026-82078CRITICALPaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorEPSS 3.8%KEVCVE-2019-10174HIGHA vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application clEPSS 3.1%CVE-2023-33652HIGHSitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componenEPSS 2.5%CVE-2023-6943CRITICALUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocketEPSS 2.1%CVE-2024-28121HIGHReflex arbitrary method call in stimulus_reflexEPSS 1.6%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 1.3%CVE-2026-42027CRITICALApache OpenNLP: Arbitrary Class Instantiation via Model Manifest in ExtensionLoaderEPSS 1.3%CVE-2026-44416CRITICALApache Ranger: Remote Code Execution via Arbitrary Class InstantiationEPSS 1.2%CVE-2026-86792HIGHApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationEPSS 1.2%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-25498HIGHCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.2%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%CVE-2026-33157HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.1%