VNX-1007: Mixed-script homoglyph in source code

Field	Value
Rule ID	VNX-1007
Severity	Low
SARIF level	note
Kind	sast
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-1007
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	homoglyphs unicode spoofing cwe-1007
Source	internal/sast/rules/vnx-1007.rego

Overview

VNX-1007 maps to CWE-1007: Insufficient Visual Distinction of Homoglyphs Presented to User. It reports a word that mixes ASCII Latin letters with a Cyrillic or Greek letter that renders like a Latin one (Cyrillic а е о р с у х і ј ѕ and capitals А В Е К М Н О Р С Т Х, Greek Α Β Ε Ζ Η Ι Κ Μ Ν Ο Ρ Τ Υ Χ ο ν ρ α), written directly or as a \uXXXX escape beside a Latin letter.

Not reported: text written wholly in Cyrillic or Greek, Greek letters used as symbols (Δ, μ, Ω, π), comments, and test files, which legitimately hold homoglyph samples. The rule reads source text only; it does not judge whether a user interface renders IDN domains or usernames distinguishably.

Why This Matters

A mixed-script word looks like the ordinary one to a reviewer but compares unequal to it. "аdmin" with a Cyrillic а slips past a check against "admin", pаypal.com looks like the real domain, and an identifier spelled that way can shadow the real one without anyone noticing in review.

What Gets Flagged

BACKDOOR_USER = "аdmin"   # first letter is Cyrillic U+0430

const redirectHost = 'pаypal.com';

private static final String SUPERUSER = "аdmin";

Remediation

1. Spell names, hosts and identifiers in one script.
2. Where user-chosen names or domains are compared or displayed, normalise them (NFKC, IDNA/punycode) and reject or flag mixed-script input, for example with a Unicode confusables check (UTS #39).

References

• CWE-1007
• Unicode Technical Standard #39: Security Mechanisms
• Trojan Source

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1007
// nosec vnx-1007

Or record an ignore rule: vulnetix ignore add --rule vnx-1007 --reason "...". See Suppressing findings.