VNX-260: Password in Configuration File

Reports literal passwords in XML configuration (Maven settings.xml, Spring and Hibernate XML, Tomcat context.xml/tomcat-users.xml/server.xml password attributes, .NET Web.config appSettings and connection strings), PHP config files (define('DB_PASSWORD', ...), $config[...]['password']) and credential dotfiles (.netrc, .pgpass, .pypirc, .npmrc).

Field	Value
Rule ID	`VNX-260`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Any file
CWE	CWE-260
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`password-in-config` `cwe-260`
Source	`internal/sast/rules/vnx-260.rego`

Overview

A password written into a configuration file is committed with it, copied into every image and backup, and readable by anyone who can read the file. This maps to CWE-260: Password in Configuration File.

This rule reads the configuration shapes that the generic hard-coded password rule, VNX-SEC-014, does not: that rule already covers YAML, .properties, .ini, .conf, .env, JSON keys and password="..." attributes.

What Gets Flagged

An XML element whose name ends in password/passwd with a literal body: <password>, <smtpPassword>, <jdbc.password>.
An XML <property>, <prop>, <entry>, <param>, <parameter>, <add>, <setting> or <context-param> whose name or key ends in password/passwd/pwd, with a literal value attribute or body.
An XML attribute named for the password: Tomcat <Resource ... password="...">, <user username="..." password="..."> in tomcat-users.xml, Spring Security or ASP.NET forms credentials (a {noop} value is plaintext), a Connector keystorePass="...".
The Password=/Pwd= key of a connectionString attribute in Web.config or App.config.
PHP define('DB_PASSWORD', '...') (also _PASS, _PWD) anywhere, and $config[...]['password'] = '...' in PHP files whose path names a config, settings, database or local file.
Credential dotfiles: .netrc password entries, .pgpass lines, .pypirc password =, .npmrc _password=/_auth=.

<server>
  <id>internal-repo</id>
  <password>D3ploy-Repo-2024</password>        <!-- flagged -->
</server>
<property name="password" value="Spr1ng-DS-pass"/>   <!-- flagged -->
<add key="SmtpPassword" value="Sm7p!Relay" />        <!-- flagged -->
<user name="deployer" password="Depl0yMgr!" />      <!-- flagged (Web.config forms credentials) -->
<add name="Main" connectionString="Server=sql01;User Id=app;Password=W3bC0nf!g;" />  <!-- flagged -->

define( 'DB_PASSWORD', 'Wp-Pr0d-Pass' );          // flagged

Not flagged: placeholders and references (${...}, #{...}, {{...}}, @token@, <...>, ****), encrypted values (Maven {...}, Jasypt ENC(...), Spring {cipher}), empty values, labels, names that only contain the word (passwordEncoder, password_hint, PASSWORD_MIN_LENGTH), XML comments, config templates (.example, .sample, .template, .dist) and test resources. A password in a Java EE deployment descriptor or application-server file (server.xml, context.xml, tomcat-users.xml, web.xml, persistence.xml, hibernate.cfg.xml, standalone*.xml, *-ds.xml, jetty*.xml, weblogic*.xml and the rest of VNX-555’s list) is reported by VNX-555, the Java EE form of this weakness, and not here, so the line is not reported twice; this rule still reports the shapes VNX-555 does not read there and every other XML file. A registry-scoped .npmrc line (//host/:_password=) begins with // and is dropped by the engine’s comment scope, so only the unscoped form is reported.

Remediation

<property name="password" value="${DB_PASSWORD}"/>

define( 'DB_PASSWORD', getenv('DB_PASSWORD') );

Inject passwords from the environment or a secret manager at deploy time, encrypt Maven server passwords with mvn --encrypt-password, and rotate any password that has been committed.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-260
// nosec vnx-260

Or record an ignore rule: vulnetix ignore add --rule vnx-260 --reason "...". See Suppressing findings.