VNX-1390: Weak Authentication: HTTP Digest or NTLM authentication scheme

Reports code that selects a weak HTTP authentication scheme, HTTP Digest (MD5) or NTLM (MD4), in Python, JavaScript/TypeScript, Java/Kotlin, C# and Go clients and servers.

Field	Value
Rule ID	`VNX-1390`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, JavaScript / TypeScript, Java, Kotlin, C#, Go
CWE	CWE-1390
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`weak-authentication` `ntlm` `digest-auth` `cwe-1390`
Source	`internal/sast/rules/vnx-1390.rego`

Overview

VNX-1390 maps to CWE-1390: Weak Authentication. CWE-1390 is a class; the concrete form this rule sees is code that chooses HTTP Digest or NTLM authentication. Digest computes its response from MD5 over the password and NTLM from an unsalted MD4 hash, so a captured exchange can be cracked offline and NTLM can be relayed or replayed with the hash alone.

What Gets Flagged

requests.get(url, auth=HTTPDigestAuth(user, pw))
session_auth = HttpNtlmAuth("CORP\\svc", os.environ["SVC_PW"])
auth = HTTPDigestAuth()          # Flask-HTTPAuth server

passport.use(new DigestStrategy({ qop: "auth" }, verify));
httpntlm.get({ url, username, password, domain: "CORP" }, cb);
const client = new DigestClient(user, pass);   // DigestClient = require("digest-fetch")

p.setCredentials(AuthScope.ANY, new NTCredentials(user, pass, host, "CORP"));
val nt = NTCredentials(user, pass.toCharArray(), host, "CORP")   // Kotlin

cache.Add(uri, "NTLM", cred);
listener.AuthenticationSchemes = AuthenticationSchemes.Ntlm;

client := &http.Client{Transport: &digest.Transport{Username: u, Password: p}}   // github.com/icholy/digest

Not flagged: Basic, Bearer and Negotiate (Kerberos), imports and class definitions of these names, doctests, comments, strings and test code. Basic credentials over cleartext http:// are reported by VNX-523, and plaintext password comparison by VNX-309.

Remediation

Use a token scheme (OAuth 2.0 / OpenID Connect bearer tokens) or mutual TLS.
On Windows networks, prefer Negotiate (Kerberos) and disable NTLM fallback.
If Basic must be used, send it only over TLS and to a dedicated, rate-limited endpoint.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1390
// nosec vnx-1390

Or record an ignore rule: vulnetix ignore add --rule vnx-1390 --reason "...". See Suppressing findings.