Falhas do tipo CWE-470

91 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2021-21985CRITICALThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plEPSS 100.0%KEVCVE-2024-4990HIGHUnsafe Reflection in base Component class in yiisoft/yii2EPSS 80.2%CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2025-3600HIGHUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXEPSS 24.1%CVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 14.1%CVE-2022-23744—Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bEPSS 4.6%CVE-2022-41853HIGHRemote code execution in HyperSQL DataBaseEPSS 3.9%CVE-2026-82078CRITICALPaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorEPSS 3.6%KEVCVE-2019-10174HIGHA vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application clEPSS 3.1%CVE-2023-33652HIGHSitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componenEPSS 2.5%CVE-2023-6943CRITICALUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocketEPSS 2.1%CVE-2024-28121HIGHReflex arbitrary method call in stimulus_reflexEPSS 1.6%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-86792HIGHApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationEPSS 1.2%CVE-2026-33157HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.0%CVE-2019-3834MEDIUMIt was found that the fix for CVE-2014-0114 had been reverted in JBoss Operations Network 3 (JON). This flaw allows attackers to manipulate EPSS 1.0%CVE-2020-7857HIGHA vulnerability of XPlatform could allow an unauthenticated attacker to execute arbitrary command. This vulnerability exists due to insufficEPSS 1.0%CVE-2026-44795HIGHSpinnaker: Non-safe yaml deserialization allowing RCE when using specific typesEPSS 1.0%CVE-2026-25498HIGHCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.0%CVE-2025-63690CRITICALIn pig-mesh Pig versions 3.8.2 and below, when setting up scheduled tasks in the Quartz management function under the system management moduEPSS 1.0%