VNX-1392: Use of Default Credentials: default account with a default password

Field	Value
Rule ID	VNX-1392
Severity	Low
SARIF level	note
Kind	sast
Languages	Python, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, Dockerfile
CWE	CWE-1392
CAPEC	CAPEC-70
ATT&CK	T1078.001
CWSS vector	CWSS:1.0/TI:L/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	use-of-default-credentials credentials cwe-1392
Source	internal/sast/rules/vnx-1392.rego

Overview

VNX-1392 maps to CWE-1392: Use of Default Credentials. A default account with its default password (admin/admin, root/root, guest/guest, postgres/postgres, elastic/changeme, sa or root with no password) is the first pair credential-stuffing tools try. The rule reports the pair when the account is one of admin, administrator, root, sa, guest, postgres, elastic, tomcat, pi, oracle, system, mysql, and the password equals the account name, is a vendor default, is a wordlist-weak value, or is empty for root/sa.

What Gets Flagged

DATABASE_URL = "postgres://postgres:postgres@db:5432/app"
requests.get(url, auth=HTTPBasicAuth("admin", "admin"))
mysql.connector.connect(host="db", user="root", password="")

$conn = mysqli_connect("localhost", "root", "root", "shop");

RABBITMQ_DEFAULT_USER: guest
RABBITMQ_DEFAULT_PASS: guest
- MYSQL_ROOT_PASSWORD=root

<user name="admin" password="admin" />

sql.Open("mysql", "root:root@tcp(mysql:3306)/inventory")

const string Conn = "Server=sql01;Database=Shop;User Id=sa;Password=sa;";

A default pair is reported once, on the line that holds the password; the account line beside it is not a separate finding.

Not flagged: a non-default account (app, ops) even with a default password, a strong password, environment or secret references, comparisons, text inside a longer string or a comment, test code and config templates. A default password on its own is VNX-1393; a weak one is VNX-1391.

Remediation

1. Disable or rename the built-in account, or create a dedicated least-privilege account for the application.
2. Generate a unique password per deployment and inject it from a secrets manager.
3. Never leave root or sa with an empty password, even in development images that might be published.

References

• CWE-1392: Use of Default Credentials
• CAPEC-70: Try Common or Default Usernames and Passwords

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1392
// nosec vnx-1392

Or record an ignore rule: vulnetix ignore add --rule vnx-1392 --reason "...". See Suppressing findings.