Falhas do tipo CWE-470

131 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2021-21985CRITICALThe vSphere Client (HTML5) contains a remote code execution vulnerability due to lack of input validation in the Virtual SAN Health Check plEPSS 100.0%KEVCVE-2024-4990HIGHUnsafe Reflection in base Component class in yiisoft/yii2EPSS 80.1%CVE-2024-0200HIGHUnsafe Reflection in Github Enterprise Server leading to Command InjectionEPSS 71.7%CVE-2026-82078CRITICALPaperCut MF/NG: Unsafe Dynamic Class Loading in Database ConnectorEPSS 63.0%KEVCVE-2025-3600HIGHUnsafe Reflection Vulnerability in Telerik UI for ASP.NET AJAXEPSS 26.3%CVE-2025-53693CRITICALHTML Cache Poisoning through Unsafe ReflectionsEPSS 20.3%CVE-2022-41853HIGHRemote code execution in HyperSQL DataBaseEPSS 5.1%CVE-2022-23744—Check Point Endpoint before version E86.50 failed to protect against specific registry change which allowed to disable endpoint protection bEPSS 4.6%CVE-2019-10174HIGHA vulnerability was found in Infinispan such that the invokeAccessibly method from the public class ReflectionUtil allows any application clEPSS 3.1%CVE-2023-33652HIGHSitecore Experience Platform (XP) v9.3 was discovered to contain an authenticated remote code execution (RCE) vulnerability via the componenEPSS 2.5%CVE-2023-6943CRITICALUse of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Mitsubishi Electric Corporation EZSocketEPSS 2.1%CVE-2024-28121HIGHReflex arbitrary method call in stimulus_reflexEPSS 1.6%CVE-2026-102094HIGHKiteworks Email Protection Gateway unsafe reflectionEPSS 1.5%CVE-2026-44416CRITICALApache Ranger: Remote Code Execution via Arbitrary Class InstantiationEPSS 1.2%CVE-2026-86792HIGHApache Airflow Apache Kafka provider: Connection-editor remote code execution on the Scheduler via Kafka connection callback configurationEPSS 1.2%CVE-2026-58400CRITICALGeoNetwork vulnerable to Remote Code Execution via unsafe Saxon XSLT processor configuration in formatterEPSS 1.2%CVE-2026-65608HIGHGrav before 2.0.9 Remote Code Execution via FlexDirectoryEPSS 1.1%CVE-2026-33157HIGHCraft CMS: Potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.1%CVE-2026-25498HIGHCraft has a potential authenticated Remote Code Execution via malicious attached BehaviorEPSS 1.1%CVE-2026-62379CRITICALOpenAM: Unauthenticated Remote Code Execution via Class.forName in AuthXMLUtils.createCustomCallbackEPSS 1.1%