VNX-1204: Generation of Weak Initialization Vector (IV)

Field	Value
Rule ID	VNX-1204
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java
CWE	CWE-1204
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	generation-of-weak-iv cwe-1204
Source	internal/sast/rules/vnx-1204.rego

Overview

VNX-1204 maps to CWE-1204: Generation of Weak Initialization Vector (IV). Reports Java code that builds a cipher IV or nonce (IvParameterSpec, GCMParameterSpec, ChaCha20ParameterSpec) from bytes that are not freshly random: a zero-filled new byte[N] passed straight to the spec; a byte[] allocated with new byte[N] and handed to the spec within the next 40 lines without anything filling it (no nextBytes, read, readFully, ByteBuffer.get, System.arraycopy, element assignment or other call that takes the array); a byte[] initialised from a literal ({…}, new byte[]{…}, “…”.getBytes()) that the file uses as an IV; a string literal’s bytes passed to the spec; and an IV filled by java.util.Random or ThreadLocalRandom.nextBytes. A zero, constant or predictable IV repeats across messages, which leaks plaintext equality under CBC and breaks confidentiality and authentication under CTR and GCM. Not reported: IVs filled by SecureRandom, IVs read from the message being decrypted, cipher.getIV(), byte arrays never used as an IV, strings and comments. Overlaps VNX-JAVA-020 (static IV) and VNX-329 (predictable IV); VNX-CRYPTO-010 (hard-coded IV, nonce or salt) leaves the Java IV lines this rule reports to it.

Why This Matters

This weakness class (Generation of Weak Initialization Vector (IV)) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-1204 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

c.init(Cipher.ENCRYPT_MODE, key, new IvParameterSpec(new byte[16]));  // FLAGGED

byte[] iv = new byte[16];                    // FLAGGED: never filled
cipher.init(Cipher.ENCRYPT_MODE, k, new IvParameterSpec(iv));

private static final byte[] IV_BYTES = { 0x00, 0x01, /* ... */ };  // FLAGGED

rnd.nextBytes(iv);                           // FLAGGED when rnd is java.util.Random

new SecureRandom().nextBytes(iv);            // not flagged

Remediation

1. Review each flagged line and determine whether the pattern represents a real instance of CWE-1204 or a false positive.
2. Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-1204 comment on the line.
4. Ensure equivalent test coverage exists to prevent regression.

References

• CWE-1204: Generation of Weak Initialization Vector (IV)
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1204
// nosec vnx-1204

Or record an ignore rule: vulnetix ignore add --rule vnx-1204 --reason "...". See Suppressing findings.