VNX-1304: Security state restored from unprotected saved state

Field	Value
Rule ID	VNX-1304
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, Kotlin
CWE	CWE-1304
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	saved-state-integrity android cwe-1304
Source	internal/sast/rules/vnx-1304.rego

Overview

VNX-1304 maps to CWE-1304: Improperly Preserved Integrity of Hardware Configuration State During a Power Save/Restore Operation. CWE-1304 is a hardware weakness: configuration saved before a low-power state is restored afterwards without an integrity check. Hardware save/restore is not visible in application source, so the rule reports the nearest software analogue: a security decision saved across a process stop and restored as trusted.

Reported: getBoolean, getString or getInt whose key names a security decision (logged in, authenticated, admin, role, PIN or biometric verified, unlocked, premium or licensed, access level), as a literal or as a constant of the same file, called on

• plain SharedPreferences (a variable typed SharedPreferences or assigned from getSharedPreferences/getDefaultSharedPreferences, or a call chained onto one), which a rooted device or a backup restore can edit; or
• a saved-instance Bundle (savedInstanceState, a variable typed Bundle), restored after process death, which skips re-authentication.

Not reported: EncryptedSharedPreferences, keys that are not security decisions (theme, language, scroll position), the same getters on JSON objects or Intents, test code and comments.

What Gets Flagged

SharedPreferences prefs = getSharedPreferences("bank", MODE_PRIVATE);
boolean loggedIn = prefs.getBoolean("isLoggedIn", false);   // FLAGGED

@Override
protected void onRestoreInstanceState(Bundle savedInstanceState) {
    pinVerified = savedInstanceState.getBoolean("pin_verified");   // FLAGGED
}

What Is Not Flagged

boolean dark = prefs.getBoolean("dark_mode", false);
boolean authenticated = response.getBoolean("authenticated");   // a JSON response

Remediation

1. Re-establish authentication and authorisation after a restart: ask the user again or confirm with the server.
2. Keep any persisted security state in EncryptedSharedPreferences or the Android Keystore, and treat it as a hint, not a decision.
3. Do not restore a “PIN verified” or “unlocked” flag from savedInstanceState.

References

• CWE-1304
• OWASP MASVS: Storage

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1304
// nosec vnx-1304

Or record an ignore rule: vulnetix ignore add --rule vnx-1304 --reason "...". See Suppressing findings.