VNX-214: Invocation of Process Using Visible Sensitive Information

Detects passwords, tokens and secrets passed to child processes on the command line (--password=$x, mysql -p$x, sshpass -p $x, docker login -p $x, curl -u user:$x, redis-cli -a $x, openssl pass:$x, kubectl create secret --from-literal=password=$x, aws configure set aws_secret_access_key $x, htpasswd -b, a password inside a URL argument) from Python, JavaScript/TypeScript, Go, Java, PHP and C# exec calls, and from shell scripts, Makefiles and Dockerfiles.

Field	Value
Rule ID	`VNX-214`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python, Go, Java, PHP, C#, Shell, Dockerfile
CWE	CWE-214
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`visible-sensitive-info` `command-line` `process-arguments` `cwe-214`
Source	`internal/sast/rules/vnx-214.rego`

Overview

VNX-214 maps to CWE-214: Invocation of Process Using Visible Sensitive Information. A process’s arguments are public on the host: any local user can read them with ps or from /proc/<pid>/cmdline, and they are recorded by process accounting, audit logs, CI logs and crash reports. A password passed as an argument is therefore disclosed to everyone on the machine for as long as the process runs.

The rule reports a credential argument whose value is dynamic (a variable, concatenation, interpolation or format verb):

a credential flag: --password, --passwd, --pass, --secret, --token, --api-key, --client-secret, --access-token, --auth-token (also prefixed, such as --db-password), attached (--password= + x), interpolated (f"--token={t}", `--api-key=${k}`, {1}, %s) or as the next element of an argument list (["--token", tok]);
mysql/mysqldump/mysqladmin/mariadb -p<value> built from a variable;
sshpass -p <variable>, redis-cli -a <variable>, openssl ... -passout pass:<value>, npm :_authToken=<value>;
a URL argument with the password in it: f"--dbname=postgresql://{user}:{password}@{host}/{db}".

In code the line that builds the argument is reported, wherever it is executed later; an argument list passed to subprocess, child_process, exec.Command, ProcessBuilder/Runtime.exec, PHP exec/system/proc_open/Symfony Process, or C# Process.Start/ProcessStartInfo is reported at the call. In shell scripts, Makefiles and Dockerfiles the same flags with a $ value are reported, plus docker login -p "$X", curl -u "user:$X", openssl -pass pass:"$X", redis-cli -a "$X" and clients given a URL such as pg_dump "postgresql://app:${DB_PASSWORD}@db/app" or git clone "https://x-access-token:$TOKEN@github.com/...".

What Gets Flagged

subprocess.run(["mysqldump", "-u", user, f"-p{password}", db], check=True)   # FLAGGED

return exec.Command("mysqldump", "-u", user, "-p"+password, db).Run()   // FLAGGED

spawn('sshpass', ['-p', password, 'ssh', host]);   // FLAGGED

mysqldump -u "$DB_USER" -p"$DB_PASSWORD" shop > /backups/shop.sql          # FLAGGED
docker login -u "$REGISTRY_USER" -p "$REGISTRY_TOKEN" registry.example.com  # FLAGGED
openssl pkcs12 -export -in cert.pem -out bundle.p12 -passout pass:"$P12_PASSWORD"   # FLAGGED

What Is Not Flagged

A connection URL built for a library driver (create_engine(f"postgresql://{u}:{p}@h/db")) rather than a command.
Credentials passed through the environment (MYSQL_PWD, PGPASSWORD, env=, openssl -pass env:VAR), stdin (--password-stdin, input=) or a file (--password-file, --defaults-extra-file, sshpass -f/-e).
A bare -p that prompts, and -p meaning port or parents (docker run -p, ssh -p, mkdir -p).
CLI option definitions (add_argument("--password", ...), @click.option("--api-key", ...)).
Literal credentials in shell scripts (VNX-BASH-005 reports those), comments and test code.

Remediation

subprocess.run(["mysqldump", "-u", user, db], env={**os.environ, "MYSQL_PWD": password}, check=True)

printf '%s' "$REGISTRY_TOKEN" | docker login -u "$REGISTRY_USER" --password-stdin registry.example.com

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-214
// nosec vnx-214

Or record an ignore rule: vulnetix ignore add --rule vnx-214 --reason "...". See Suppressing findings.