VNX-1393: Use of Default Password

Field	Value
Rule ID	VNX-1393
Severity	Low
SARIF level	note
Kind	sast
Languages	Python, JavaScript / TypeScript, Go, Java, PHP, Ruby, C#, Dockerfile
CWE	CWE-1393
CAPEC	CAPEC-70
ATT&CK	T1078.001
CWSS vector	CWSS:1.0/TI:L/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	use-of-default-password credentials cwe-1393
Source	internal/sast/rules/vnx-1393.rego

Overview

VNX-1393 maps to CWE-1393: Use of Default Password. Vendor and framework defaults are the first credentials an attacker tries, and they appear in public documentation and wordlists. The rule reports a password-named key (ending in password, passwd, pwd, passphrase or _pass) whose value is exactly one of: password, admin, administrator, root, toor, changeme, changeit, change_me, default, guest, secret, postgres, mysql, oracle, manager, tomcat, raspberry.

What Gets Flagged

DB_PASSWORD = "postgres"
psycopg2.connect(host="db", user="app", password="password")
SMTP_PASSWORD = os.environ.get("SMTP_PASSWORD", "secret")   # default when unset

rabbitPass: process.env.RABBIT_PASSWORD || "guest",

environment:
  POSTGRES_PASSWORD: postgres
  - REDIS_PASSWORD=root
  DB_PASSWORD: ${DB_PASSWORD:-changeme}

server.ssl.key-store-password=changeit

Not flagged: comparisons (if password == "admin"), labels and field names ("Password", PASSWORD_FIELD = "password"), a literal that starts a concatenation, text inside a longer string or a comment, test, fixture and docs paths, and config templates (.env.example, .sample, .dist). Weak but non-default values such as 123456 are VNX-1391; a default password set for a default account (<user name="admin" password="admin" />, a USERNAME = "admin" constant above PASSWORD = "admin", MYSQL_ROOT_PASSWORD=root, User Id=sa;Password=password) is reported by VNX-1392 as a default credential pair, so the line is reported once; hard-coded passwords in general are VNX-SEC-014 and VNX-259.

Remediation

1. Generate a unique, random secret per deployment and inject it from a secrets manager or the environment.
2. Do not fall back to a default: fail to start when the variable is unset.
3. Force a change of any vendor default at first use (initial admin, keystore, database superuser).

References

• CWE-1393: Use of Default Password
• OWASP ASVS V2.3: Authenticator Lifecycle

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-1393
// nosec vnx-1393

Or record an ignore rule: vulnetix ignore add --rule vnx-1393 --reason "...". See Suppressing findings.