VNX-578: EJB Bad Practices: Use of Class Loader

Field	Value
Rule ID	VNX-578
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-578
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	ejb classloader cwe-578
Source	internal/sast/rules/vnx-578.rego

Overview

VNX-578 maps to CWE-578: EJB Bad Practices: Use of Class Loader. The EJB specification forbids a bean to create a class loader, obtain the current one, set the context class loader or define classes. The container controls class loading to keep applications isolated and to apply its security policy; a bean that loads code itself can run classes the container never vetted and reach classes of other deployed applications.

What Gets Flagged

A class counts as an EJB when its file imports javax.ejb or jakarta.ejb and declares @Stateless, @Stateful, @Singleton or @MessageDriven, or implements SessionBean, EntityBean or MessageDrivenBean. In such a file:

@Stateless
public class PluginService {
    public Object load(URL jar, String type) throws Exception {
        try (URLClassLoader loader = new URLClassLoader(new URL[] {jar})) {
            ...

ClassLoader previous = Thread.currentThread().getContextClassLoader();
Thread.currentThread().setContextClassLoader(custom);
return getClass().getClassLoader().getResourceAsStream("cart-rules.xml");
ClassLoader sys = ClassLoader.getSystemClassLoader();

Instantiating a ClassLoader subclass declared in the file, and defineClass/defineHiddenClass calls, are reported too.

What Is Not Flagged

• The same calls in Spring beans, servlets and other classes that are not EJBs.
• Class.forName.
• A ClassLoader subclass that is declared but never instantiated.
• Test code, comments and string literals.

Remediation

1. Let the container load classes: inject dependencies with @EJB/@Inject and package plugins as part of the deployment.
2. Read bundled resources through the container (@Resource, JNDI) or move the class-loading work into a component that is not an enterprise bean.

References

• CWE-578: EJB Bad Practices: Use of Class Loader

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-578
// nosec vnx-578

Or record an ignore rule: vulnetix ignore add --rule vnx-578 --reason "...". See Suppressing findings.