Falhas do tipo CWE-470

129 resultados

Reflexão insegura com entrada controlada externamente

A aplicação usa entrada do usuário (parâmetros HTTP, arquivos, etc.) diretamente em mecanismos de reflexão (Class.forName, getMethod, etc.) para carregar classes ou executar métodos dinamicamente, sem validação. Um atacante controla qual classe é instanciada ou qual método é chamado, podendo executar código arbitrário ou acessar funcionalidades internas não previstas.

Exemplo

Uma API web recebe o parâmetro 'classname' via GET e faz Class.forName(request.getParameter("classname")).newInstance(). Um atacante passa classname=java.lang.Runtime e consegue executar comandos no servidor, ou carrega uma classe maliciosa do classpath.

Como mitigar

Valide e restrinja a entrada: use uma whitelist de classes/métodos permitidos, compare hashes ou nomes contra uma lista fixa. Nunca passe entrada bruta diretamente a Class.forName() ou reflection APIs. Se possível, use um padrão Factory ou strategy map ao invés de reflexão dinâmica com entrada externa.

CVE-2017-20285CRITICALYAML versions before 1.30 for Perl allow a loaded document to trigger the DESTROY method of arbitrary classesEPSS 0.3%CVE-2026-57284MEDIUMJenkins Pipeline: Groovy Plugin 4331.v9d06ed4658ff and earlier does not restrict the types that can be instantiated through the Pipeline SniEPSS 0.3%CVE-2026-104629HIGHGrid Protection Alliance openPDC and openHistorian Use of Externally-Controlled Input to Select Classes or CodeEPSS 0.3%CVE-2026-108097—Drupal core - Critical - Remote code execution - SA-CORE-2026-014EPSS 0.3%CVE-2026-112075MEDIUMunslothai unsloth sentence_transformer.py externally-controlled input to select classes or codeEPSS 0.3%CVE-2026-108099—Entity List - Critical - Remote code execution - SA-CONTRIB-2026-218EPSS 0.3%CVE-2026-41175HIGHStatamic: Unsafe method invocation via query value resolution allows data destructionEPSS 0.3%CVE-2026-19135MEDIUMOpenNMS JEXL sandbox bypass in Measurements REST API allows ROLE_USER to load arbitrary classesEPSS 0.3%CVE-2026-23923MEDIUMUnauthenticated arbitrary PHP class instantiationEPSS 0.3%CVE-2026-111851HIGHWordPress Royal Elementor Addons plugin <= 1.7.1068 - Arbitrary Code Execution vulnerabilityEPSS 0.3%CVE-2026-106440HIGHHydra: Optuna custom_search_space can resolve and execute untrusted callables via get_methodEPSS 0.3%CVE-2026-18123HIGHIBM Financial Transaction Manager (FTM) is Impacted by Multiple VulnerabilitiesEPSS 0.3%CVE-2026-102580LOWMoodle: arbitrary class instantiation via report builder audience classnameEPSS 0.2%CVE-2026-105064MEDIUMWordPress Unlimited Elements For Elementor (Free Widgets, Addons, Templates) plugin <= 2.0.22 - Broken Access Control vulnerabilityEPSS 0.2%CVE-2024-8048HIGHTelerik Reporting Insecure Expression EvaluationEPSS 0.2%CVE-2026-115749MEDIUMhydra-ray-launcher 1.1.0.dev1 before 1.2.2 and 1.4.0.dev4 before 1.4.0rc2 Arbitrary Module ImportEPSS 0.2%CVE-2026-48817MEDIUMStarlette: Arbitrary HTTP method dispatched to `HTTPEndpoint` attributes via `getattr`EPSS 0.2%CVE-2026-55543HIGHTuxGuitar: Arbitrary Code Execution via maliciously crafted `.tg` fileEPSS 0.2%CVE-2026-114660HIGHGrav 2.0.0 before 2.2.5 Unauthorized Page Deletion via Flex Form DirectivesEPSS 0.2%CVE-2026-66269HIGHDell OpenManage Server Administrator, versions prior to 11.1.0.3, contains a Use of Externally-Controlled Input to Select Classes or Code ('EPSS 0.2%