VNX-1188: Initialization of a Resource with an Insecure Default

Field	Value
Rule ID	VNX-1188
Severity	Medium
SARIF level	warning
Kind	sast
Languages	JavaScript / TypeScript, Python
CWE	CWE-1188
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	insecure-default cwe-1188
Source	internal/sast/rules/vnx-1188.rego

Overview

VNX-1188 maps to CWE-1188: Initialization of a Resource with an Insecure Default. Reports a security setting that is initialised to its insecure value whenever nobody configures it. Python: a top-level DEBUG = True in a settings module that is not a development/local/test settings file, and an environment or config read (os.environ.get, os.getenv, os.environ.setdefault, decouple config(), django-environ env()/env.bool()) whose fallback value turns on a debug/insecure switch (DEBUG as the last word of the name, DEBUG_MODE, ALLOW_INSECURE, SKIP_TLS_VERIFY, DISABLE_AUTH, DISABLE_CSRF, NO_AUTH, CORS_ALLOW_ALL …) or turns off a protection (VERIFY_SSL, TLS_VERIFY, CHECK_CERT, REQUIRE_AUTH, AUTH_ENABLED, CSRF_ENABLED, SECURE_COOKIES, SESSION_COOKIE_SECURE, SECURE_SSL_REDIRECT, HTTPS_ONLY, COOKIE_SECURE, REJECT_UNAUTHORIZED …). Pydantic BaseSettings: a bool field declared directly in a class deriving from BaseSettings whose default is the insecure value (debug: bool = True, verify_ssl: bool = False). JavaScript/TypeScript: process.env.NAME || value or ?? value with the same insecure fallback, a destructuring default from process.env (const { DEBUG = ‘true’ } = process.env), process.env.INSECURE_SWITCH !== ‘false’ (on unless disabled) and process.env.PROTECTION === ‘true’ (off unless enabled). Not reported: a secure fallback (DEBUG defaulting to False, VERIFY_SSL defaulting to True), a read with no fallback, non-boolean settings, names that configure a debug tool rather than a debug mode (DEBUG_COLORS, DEBUG_PORT), a read quoted inside a string literal, a BaseSettings subclass of a project base class (the base is not followed), DEBUG = True in dev/local/test settings files or indented inside a class or docstring, comments, strings and test files. DEBUG turned on in a Django deployment settings module (DEBUG = True, or DEBUG read from the environment with a true default) is reported by VNX-PY-006, not here.

Why This Matters

This weakness class (Initialization of a Resource with an Insecure Default) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1188 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

DEBUG = True                                         # FLAGGED (config.py of a non-Django app)
DEBUG = True                                         # reported by VNX-PY-006 (Django settings.py)
WEB_DEBUG = os.environ.get("WEB_DEBUG", True)        # FLAGGED
VERIFY_SSL = os.getenv("VERIFY_SSL", "false") == "true"  # FLAGGED
DEBUG = os.getenv("DEBUG", "False") == "True"        # not flagged

// JavaScript
skipVerify: process.env.SKIP_TLS_VERIFY !== 'false',  // FLAGGED
secureCookies: process.env.SECURE_COOKIES === 'true',  // FLAGGED

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1188 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1188 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1188: Initialization of a Resource with an Insecure Default
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1188
// nosec vnx-1188

Or record an ignore rule: vulnetix ignore add --rule vnx-1188 --reason "...". See Suppressing findings.