CWE-578 EJB Bad Practices: Use of Class Loader

The product violates the Enterprise JavaBeans (EJB) specification by using the class loader.

• Confidentiality, Integrity, Availability, Other: Execute Unauthorized Code or Commands, Varies by Context — The specification [REF-1543] justifies this requirement in the following way: "These functions are reserved for the EJB container. Allowing the enterprise bean to use these functions could compromise security and decrease the container's ability to properly manage the runtime environment."

• [Architecture and Design, Implementation] Do not use the Class Loader when writing EJBs.

• Automated Static Analysis: Automated static analysis, commonly referred to as Static Application Security Testing (SAST), can find some instances of this weakness by analyzing source code (or binary/compiled code) without having to execute it. Typically, this is done by building a model of data flow and control flow, then searching for potentially-vulnerable patterns that connect "sources" (origins of input) with "sinks" (destinations where the data interacts with external components, a lower layer such as the OS, etc.)