VNX-1027: Request data in a require() or import() module specifier (Node.js)
Reports Node.js require(), require.resolve() and dynamic import() calls whose module specifier contains Express or Koa request data, letting a caller choose which file the server loads and runs.
| Field | Value |
|---|---|
| Rule ID | VNX-1027 |
| Severity | Low |
| SARIF level | note |
| Kind | sast |
| Languages | JavaScript / TypeScript |
| CWE | CWE-1027 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:L/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L |
| Tags | injection dynamic-require code-injection cwe-1027 |
| Source | internal/sast/rules/vnx-1027.rego |
Overview
VNX-1027 maps to CWE-1027: OWASP Top Ten 2017 Category A1 - Injection. It covers the injection class that has no other rule: the module a Node.js process loads chosen by the request. It reports require(), require.resolve() and dynamic import() whose specifier contains Express/Koa request data (req.query, req.body, req.params, req.headers, req.cookies, ctx.query, ctx.params, ctx.request.body), directly, through a variable assigned or destructured from it a few lines above, or concatenated or interpolated into a path.
Not reported: constant specifiers, lookups through an object or Map (require(PLUGINS[name])), values checked against an allowlist (includes, has, indexOf, switch, ===) in the lines between, comments and test files. Other A1 injection classes have their own rules: eval/Function/vm (VNX-913, VNX-94), child_process (VNX-NODE-003), SQL (VNX-NODE-007), NoSQL (VNX-NODE-014), templates (VNX-NODE-011).
Why This Matters
require() runs the file it loads. With a request-controlled specifier, ../../ traversal or an uploaded .js file turns the endpoint into remote code execution with the server’s privileges.
What Gets Flagged
const plugin = require(req.query.name);
const renderer = require('./themes/' + theme); // theme = req.body.themeconst mod = await import(`./locales/${lang}.js`); // lang from req.headersRemediation
- Map the request value through a fixed table of allowed modules:
const plugin = PLUGINS[req.query.name]. - If the set is open-ended, validate the value against an explicit allowlist before loading anything.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1027
// nosec vnx-1027Or record an ignore rule: vulnetix ignore add --rule vnx-1027 --reason "...". See Suppressing findings.