CWE-575 Variant Draft

EJB Bad Practices: Use of AWT Swing

This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles.

Definition

What is CWE-575?

This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles.
The EJB specification explicitly prohibits beans from using AWT or Swing to handle user input or display output. This rule exists because EJB components are designed to run on application servers, which typically operate in headless environments without direct access to a keyboard, monitor, or graphical interface. Attempting to create UI elements in this context will fail or cause unpredictable behavior, breaking the application's portability across different EJB containers. For developers, this means all business logic within your EJB must remain separate from presentation-layer code. Instead of embedding AWT/Swing, user interactions should be handled by a dedicated client-tier application (like a web front-end or desktop client) that communicates with the EJB layer remotely. Adhering to this separation ensures your bean remains portable, scalable, and consistent with the server-side execution model intended for enterprise applications.
Auswirkungen in der Praxis

Real-world CVEs caused by CWE-575

Bisher sind in MITREs Katalog keine öffentlichen CVE-Referenzen mit dieser CWE verknüpft.

Wie Angreifer es ausnutzen

Angreiferpfad Schritt für Schritt

  1. 1

    The following Java example is a simple converter class for converting US dollars to Yen. This converter class demonstrates the improper practice of using a stateless session Enterprise JavaBean that implements an AWT Component and AWT keyboard event listener to retrieve keyboard input from the user for the amount of the US dollars to convert to Yen.

  2. 2

    This use of the AWT and Swing APIs within any kind of Enterprise JavaBean not only violates the restriction of the EJB specification against using AWT or Swing within an EJB but also violates the intended use of Enterprise JavaBeans to separate business logic from presentation logic.

  3. 3

    The Stateless Session Enterprise JavaBean should contain only business logic. Presentation logic should be provided by some other mechanism such as Servlets or Java Server Pages (JSP) as in the following Java/JSP example.

Verwundbares Codebeispiel

Vulnerable Java

The following Java example is a simple converter class for converting US dollars to Yen. This converter class demonstrates the improper practice of using a stateless session Enterprise JavaBean that implements an AWT Component and AWT keyboard event listener to retrieve keyboard input from the user for the amount of the US dollars to convert to Yen.

Verwundbar Java
@Stateless
  public class ConverterSessionBean extends Component implements KeyListener, ConverterSessionRemote {
```
/* member variables for receiving keyboard input using AWT API */* 
  		
  		...
  		private StringBuffer enteredText = new StringBuffer();
  		
  		
  		 */* conversion rate on US dollars to Yen */* 
  		
  		private BigDecimal yenRate = new BigDecimal("115.3100");
  		
  		public ConverterSessionBean() {
  		```
  				super();
```
/* method calls for setting up AWT Component for receiving keyboard input */* 
  				
  				...
  				addKeyListener(this);}
  		
  		public BigDecimal dollarToYen(BigDecimal dollars) {
  		```
  			BigDecimal result = dollars.multiply(yenRate);
  			return result.setScale(2, BigDecimal.ROUND_DOWN);
  		}
```
/* member functions for implementing AWT KeyListener interface */* 
  		
  		public void keyTyped(KeyEvent event) {
  		```
  			...
  		}
  		public void keyPressed(KeyEvent e) {
  		}
  		public void keyReleased(KeyEvent e) {
  		}
```
/* member functions for receiving keyboard input and displaying output */* 
  		
  		public void paint(Graphics g) {...}
  		
  		...}
Sicheres Codebeispiel

Secure Java

The Stateless Session Enterprise JavaBean should contain only business logic. Presentation logic should be provided by some other mechanism such as Servlets or Java Server Pages (JSP) as in the following Java/JSP example.

Sicher Java
@Stateless
  public class ConverterSessionBean implements ConverterSessionRemoteInterface {
```
/* conversion rate on US dollars to Yen */* 
  		private BigDecimal yenRate = new BigDecimal("115.3100");
  		
  		public ConverterSessionBean() {
  		}
  		
  		
  		 */* remote method to convert US dollars to Yen */* 
  		
  		public BigDecimal dollarToYen(BigDecimal dollars) {
  		```
  			BigDecimal result = dollars.multiply(yenRate);
  			return result.setScale(2, BigDecimal.ROUND_DOWN);
  		}
  }
What changed: the unsafe sink is replaced (or the input is validated/escaped) so the same payload no longer triggers the weakness.
Präventions-Checkliste

How to prevent CWE-575

  • Architecture and Design Do not use AWT/Swing when writing EJBs.
Erkennungssignale

How to detect CWE-575

SAST High

Führe statische Analyse (SAST) auf der Codebasis aus und suche im Datenfluss nach dem unsicheren Muster.

DAST Moderate

Führe dynamische Application-Security-Tests gegen den Live-Endpoint aus.

Runtime Moderate

Beobachte Runtime-Logs auf ungewöhnliche Exception-Traces, fehlerhafte Eingaben oder Versuche, Autorisierung zu umgehen.

Code review Moderate

Code Review: Markiere jeden neuen Code, der Eingaben von dieser Oberfläche ohne validierte Framework-Helper verarbeitet.

CWE-575

Don't catalog this weakness. Prove it's reachable.

Plexicus turns CWE catalogs into evidence: every CWE-pattern is matched against your real code graph, reach is proven on a sandbox clone, and verified findings ship as reviewed PRs.

Häufig gestellte Fragen

Frequently asked questions

Was ist CWE-575?

This vulnerability occurs when an Enterprise JavaBeans (EJB) component incorrectly uses AWT or Swing UI toolkits, violating the EJB specification's design principles.

Wie gravierend ist CWE-575?

MITRE hat für diese Schwachstelle keine Exploit-Wahrscheinlichkeit veröffentlicht. Behandle sie als mittlere Auswirkung, bis dein Threat Model anderes belegt.

Welche Sprachen oder Plattformen sind von CWE-575 betroffen?

MITRE lists the following affected platforms: Java.

Wie kann ich CWE-575 verhindern?

Do not use AWT/Swing when writing EJBs.

Wie erkennt und behebt Plexicus CWE-575?

Die SAST-Engine von Plexicus erkennt die Datenfluss-Signatur von CWE-575 bei jedem Commit. Bei einem Treffer öffnet unser Codex-Remedium-Agent einen Fix-PR mit korrigiertem Code, Tests und einer einzeiligen Zusammenfassung für den Reviewer.

Wo erfahre ich mehr über CWE-575?

MITRE veröffentlicht die kanonische Definition unter https://cwe.mitre.org/data/definitions/575.html. Für ergänzende Hinweise kannst du auch die OWASP- und NIST-Dokumentation heranziehen.

Bereit, das Wesentliche zu validieren?

Bereit zu validieren, was zählt.

Plexicus ist Proof-Driven AppSec: validierte Funde, kontextuelles Verständnis und geprüfte Remediation — in Evidenz verankert, mit Ihnen gescoped.

Qualifizierung

Prüfen Sie, ob AI Swarm Pentest zu Ihrer Umgebung passt.

Teilen Sie den wichtigsten Kontext. Wir prüfen den Umfang und nennen den nächsten kommerziellen Schritt.

Vor dem Absenden — prüfen Sie, ob Sie passen

0 / 280

Keine Verpflichtung. Wenn Sie nicht passen, sagen wir es Ihnen.

SAMPLE HANDOVER · ILLUSTRATIVE

Sample evidence handover

A trimmed view of what your team receives at the end of an AI Swarm Pentest engagement. Real engagements include full technical evidence, executive narrative, and a remediation plan.

VALIDATED FINDING Evidence attached

Server-Side Request Forgery in webhooks/receiver

demo-project/sample-app · src/webhooks/receiver.py:42

SeverityHigh CVSS 3.18.6 Priority79 Confirmedvia replay

Untrusted caller-supplied URLs reach an internal egress without an allowlist. Replayed in a sandbox against a fresh authorized target — the same control was validated to fail twice.

REVIEWER-READY REMEDIATION Merge-ready PR

Validate the target URL against an allowlist of permitted hostnames. Reject private/internal IP ranges. Enforce HTTPS only.

plexicus/remediation/webhooks-ssrf 3 changed · 0 new files
42resp = requests.get(target_url)
42+if not is_allowed_host(target_url):
43+  raise WebhookRejected(target_url)
44+resp = requests.get(target_url, timeout=5)
Every engagement hands over:
  • Executive briefing
  • Validated findings list
  • Merge-ready PRs
  • Compliance mapping (NIS2 · DORA · CRA)
Private Runde Für Investoren