VNX-263: Password Aging with Long Expiration

A maximum password age is configured at more than 180 days: an AWS IAM password policy, Linux PASS_MAX_DAYS/chage, an Active Directory or Windows policy, an Entra ID domain, or an application setting naming a password's maximum age.

Field	Value
Rule ID	`VNX-263`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Python, JavaScript / TypeScript, Java, Terraform, Shell, Dockerfile, PowerShell
CWE	CWE-263
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`password-aging-long` `cwe-263`
Source	`internal/sast/rules/vnx-263.rego`

Overview

VNX-263 maps to CWE-263: Password Aging with Long Expiration. It reports a password maximum age set to more than 180 days where the value is configured, and prints the configured number of days.

Why This Matters

The maximum age bounds how long a stolen password keeps working when nobody notices the theft. At a year or more, that bound is close to meaningless: a password captured by phishing, a keylogger or a breach of another site stays valid for most of that time. If the organisation has deliberately moved away from scheduled expiry, the long value should be replaced by the controls that make that safe, not left as a pretence of aging.

What Gets Flagged

resource "aws_iam_account_password_policy" "org" {
  max_password_age = 365
}

iam.update_account_password_policy(MinimumPasswordLength=14, MaxPasswordAge=730)
PASSWORD_EXPIRY_DAYS = 365
PASSWORD_MAX_AGE = timedelta(days=500)

UpdateAccountPasswordPolicyRequest.builder().maxPasswordAge(1095).build();
public static final Duration PASSWORD_LIFETIME = Duration.ofDays(1000);

PASS_MAX_DAYS	365
chage -M 720 deploy

Set-ADDefaultDomainPasswordPolicy -Identity corp.example.com -MaxPasswordAge 365.00:00:00
net accounts /maxpwage:999

Not flagged: 180 days or fewer; 0, 99999 or -1, which switch aging off and are reported by VNX-262; other durations (sessions, tokens, certificates, password-reset links); comparisons such as user.passwordAgeDays > 365; and the settings in comments or string literals.

Remediation

Set the maximum age to the period your policy requires (for example 90 days under the CIS AWS benchmark).
If you follow NIST SP 800-63B and do not expire passwords on a schedule, remove the long value and enforce MFA, breached-password screening and forced rotation on evidence of compromise instead.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-263
// nosec vnx-263

Or record an ignore rule: vulnetix ignore add --rule vnx-263 --reason "...". See Suppressing findings.