CWE-499 (可序列化的类中包含敏感信息) — Vulnerability Class 1

CWE-499 represents a design weakness where a class containing sensitive data fails to explicitly prevent serialization, effectively rendering its internal state publicly accessible. This vulnerability arises because Java’s default serialization mechanism allows any other class to serialize the object, bypassing encapsulation controls that would normally restrict data access. Attackers typically exploit this by instantiating the vulnerable class, serializing it to a stream or file, and then deserializing it in a separate context to extract confidential information such as credentials or personal identifiers. To mitigate this risk, developers must implement the Externalizable interface or define private readObject and writeObject methods to control the serialization process. Alternatively, marking sensitive fields as transient ensures they are excluded from the serialized output, thereby preserving data confidentiality even if the class structure is compromised.