VNX-1391: Use of Weak Credentials: trivially guessable password literal

Reports a password set to a trivially guessable value (123456, qwerty, letmein, password123, admin123, p@ssw0rd, ...) in code, configuration files, docker-compose, Dockerfiles, or as the fallback of an environment lookup.

Field	Value
Rule ID	`VNX-1391`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, Dockerfile, Config files
CWE	CWE-1391
CAPEC	CAPEC-16
ATT&CK	T1110.001
CWSS vector	`CWSS:1.0/TI:L/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`weak-credential` `credentials` `cwe-1391`
Source	`internal/sast/rules/vnx-1391.rego`

Overview

VNX-1391 maps to CWE-1391: Use of Weak Credentials. A password from the top of every guessing wordlist falls to the first minutes of a brute-force or credential-spraying attempt. The rule reports a password-named key (ending in password, passwd, pwd, passphrase or _pass) whose value is an all-digit string of four or more digits, a keyboard walk (qwerty, asdf, 1q2w3e4r), a common wordlist entry (letmein, welcome, iloveyou, trustno1, abc123), or a default word with a short suffix (password123, p@ssw0rd, admin123, admin321, root1).

What Gets Flagged

ADMIN_PASSWORD = "123456"
db.create_user(email="ops@example.org", password="qwerty")
SMTP_PASSWORD = os.environ.get("SMTP_PASSWORD", "abc123")

cachePass: process.env.CACHE_PASSWORD || "1q2w3e4r",

environment:
  - REDIS_PASSWORD=admin321
  MYSQL_PASSWORD: qwerty123

Not flagged: bare vendor defaults (password, admin, changeme, …; VNX-1393), a weak password set for a default account (email: admin above password: admin123, MYSQL_ROOT_PASSWORD=admin321, User Id=sa;Password=123456), which is reported by VNX-1392 as a default credential pair so the line is reported once, strong or random literals, hashes, comparisons (password === "123456"), text inside a longer string or a comment, test code and config templates (.env.sample). Password-length policies are VNX-521.

Remediation

Generate a long random secret per deployment and inject it from a secrets manager or the environment.
For seeded accounts, generate the password at install time and force a change at first login.
Reject wordlist passwords at sign-up (for example against a breached-password list).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1391
// nosec vnx-1391

Or record an ignore rule: vulnetix ignore add --rule vnx-1391 --reason "...". See Suppressing findings.