VNX-1051: Initialization with Hard-Coded Network Resource Configuration Data
Reports a literal IPv4 address written into Python, JavaScript/TypeScript, Java or Go source as a URL host, a host/address setting, or the target of a socket or dial call. Loopback, 0.0.0.0, documentation ranges, the cloud metadata address, CIDR blocks, hostnames, comments and tests are not reported.
| Field | Value |
|---|---|
| Rule ID | VNX-1051 |
| Severity | Medium |
| SARIF level | warning |
| Kind | sast |
| Languages | Python, JavaScript / TypeScript, Java, Go |
| CWE | CWE-1051 |
| CAPEC | CAPEC-66 |
| ATT&CK | T1190 |
| CWSS vector | CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C |
| Tags | hardcoded-network-config cwe-1051 |
| Source | internal/sast/rules/vnx-1051.rego |
Overview
VNX-1051 maps to CWE-1051: Initialization with Hard-Coded Network Resource Configuration Data. It reports a literal IPv4 address that a program initialises a network resource against:
- a URL or connection string whose host is an IP literal (
"http://10.0.4.12:8080/api","postgresql://app@10.0.4.12/db"); - an IP literal assigned to, or passed as, a host, address, server, endpoint, broker, proxy or URL name (
host="10.0.4.12",DB_HOST = '10.0.4.12',Addr: "10.0.4.12:6379",factory.setHost("10.0.4.12")); - an IP literal given directly to a socket or dial API (
sock.connect(("10.0.4.12", 6379)),net.Dial("tcp", "10.0.4.12:6379"),new Socket("10.0.4.12", 80),InetAddress.getByName,net.connect(port, host)).
Why This Matters
An address in code ties the build to one network. When the service moves, fails over or is re-addressed, the code has to be changed and redeployed, and the old address may by then belong to someone else.
Not reported: loopback (127.x), 0.0.0.0, broadcast, the documentation ranges 192.0.2.0/24, 198.51.100.0/24 and 203.0.113.0/24, the cloud metadata address 169.254.169.254, CIDR blocks such as 10.0.0.0/8, hostnames such as localhost or api.example.com, dotted version strings and OIDs, comments and test files.
What Gets Flagged
DB_HOST = "10.20.4.17"
CACHE = redis.Redis(host='172.16.8.3', port=6379, db=0)
sock.connect(("192.168.40.20", 9000))conn, err := net.Dial("tcp", "10.30.1.6:6379")Not flagged:
DB_HOST = os.environ.get("DB_HOST", "localhost")
ALLOWED_NETS = ["10.0.0.0/8", "172.16.0.0/12"]Remediation
- Read hosts and URLs from configuration, environment variables or service discovery.
- Prefer a DNS name over an address so the endpoint can move without a code change.
References
Suppressing this rule
Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):
# nosec vnx-1051
// nosec vnx-1051Or record an ignore rule: vulnetix ignore add --rule vnx-1051 --reason "...". See Suppressing findings.