VNX-308: Use of Single-factor Authentication

Field	Value
Rule ID	VNX-308
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java, JavaScript / TypeScript, Python, Terraform
CWE	CWE-308
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	single-factor auth cwe-308
Source	internal/sast/rules/vnx-308.rego

Overview

VNX-308 maps to CWE-308: Use of Single-factor Authentication. It reports a setting that enforces a second authentication factor being turned off, which leaves the password as the only factor:

• a setting, property or keyword whose name says MFA/2FA/two-factor/multi-factor/OTP is required or enforced (require_mfa, mfaRequired, enforce2fa, SECURITY_TWO_FACTOR_REQUIRED, otp_enforced) assigned false, 0, "off", "disabled" or "optional" in Python, JavaScript/TypeScript or Java, including a .setMfaRequired(false) or .requireMfa(false) builder call;
• an upper-case settings constant that enables MFA (MFA_ENABLED, ENABLE_2FA, TWO_FACTOR_AUTH_ENABLED) set to false;
• a Terraform aws_cognito_user_pool with mfa_configuration = "OFF".

Not reported: a per-user flag such as user.mfaEnabled = false or a model column default (the user has not enrolled, which is not a policy), reads and comparisons (if not settings.REQUIRE_MFA), the setting turned on, test files and comments.

Why This Matters

Passwords are phished, reused and stuffed. A second factor is what stops a leaked password from becoming a compromised account; turning enforcement off, often “temporarily”, removes that protection for every user.

What Gets Flagged

# FLAGGED
MFA_ENABLED = False
app.config.update(SECURITY_TWO_FACTOR_REQUIRED=False)

// FLAGGED
export const authConfig = { mfaRequired: false };

# FLAGGED
resource "aws_cognito_user_pool" "users" {
  mfa_configuration = "OFF"
}

Not flagged: const user = { email, mfaEnabled: false }, if settings.MFA_REQUIRED == False:, mfa_configuration = "ON", login-flow state such as state.mfaRequired = false or res.json({ mfaRequired: false, token }).

Remediation

1. Enforce MFA for every account, and at least for administrators and privileged operations.
2. Prefer phishing-resistant factors (WebAuthn/passkeys, TOTP) over SMS.
3. In Cognito use mfa_configuration = "ON" (or OPTIONAL with enforcement in the application) and configure a software token MFA.

References

• CWE-308: Use of Single-factor Authentication
• OWASP Multifactor Authentication Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-308
// nosec vnx-308

Or record an ignore rule: vulnetix ignore add --rule vnx-308 --reason "...". See Suppressing findings.