CWE-470

What is CWE-470 (Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection))?

The product uses external input to determine which classes to instantiate or which code to invoke, but does not sufficiently control the input.

Vulnerability Insights

Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection) (CWE-470) represents a significant security risk across modern software systems. This weakness enables attackers to exploit code execution flaws in applications, potentially leading to unauthorized access, data exfiltration, or remote code execution. Organizations must implement defense-in-depth strategies combining static analysis, runtime monitoring, and binary analysis to detect and mitigate these vulnerabilities.

Impact on Systems

• Compromise of Application Integrity: Predictable execution flow is disrupted
• Potential Data Exposure: Depending on context, sensitive configurations may leak
• Availability Risks: Unexpected states leading to temporary denial of service

Real-World Attack Scenario

An attacker probes the system interfaces to identify areas where the input or state related to Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection) is improperly handled. Once identified, they craft a payload tailored to the specific backend architecture. By exploiting the lack of robust structural validation, the attacker is able to force the application into an unintended state, bypassing standard business logic and achieving unauthorized outcomes.

Code Examples

Vulnerable Implementation

// VULNERABLE: Unvalidated input leading to Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
function processInput(data) {
    // Missing strict validation or sanitization
    executeOrStoreConfig(data);
}

Secure Alternative

// SECURE: Proper validation mitigating Use of Externally-Controlled Input to Select Classes or Code (Unsafe Reflection)
function processInput(data) {
    if (!isValid(data)) throw new Error('Invalid input');
    const safeData = sanitize(data);
    executeOrStoreConfig(safeData);
}

Detection with Precogs AI

Precogs AI identifies unsafe reflection and dynamic class loading patterns that enable remote code execution through deserialization and class injection. Our binary analysis engine examines compiled artifacts without requiring source code access, identifying CWE-470 patterns in vendor software, containers, firmware, and third-party libraries.

Remediation

Implement proper code execution controls following secure coding guidelines. Use automated scanning tools like Precogs AI to continuously monitor for CWE-470 vulnerabilities across your software supply chain. Apply the principle of least privilege and validate all inputs from untrusted sources.