VNX-319: Cleartext Transmission of Sensitive Information

A real http://, ws:// or ftp:// endpoint used by code: passed to an HTTP, FTP or socket client, assigned to an endpoint-named variable or key, or loaded by a script or iframe src.

Field	Value
Rule ID	`VNX-319`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Go, Java, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-319
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`cleartext-transmission` `cwe-319`
Source	`internal/sast/rules/vnx-319.rego`

Overview

VNX-319 maps to CWE-319: Cleartext Transmission of Sensitive Information. It reports a cleartext http:// or ftp:// URL with a registered host name on a line that uses it as an endpoint:

passed to a client: Python requests, httpx, urllib, aiohttp; JavaScript fetch, axios, jQuery ajax, XMLHttpRequest, WebSocket, EventSource; Go http.Get/Post/NewRequest; Java new URL, URI.create, HttpRequest, OkHttp .url(), RestTemplate, WebClient, HttpGet; PHP curl, file_get_contents, fopen, Guzzle, wp_remote_*; Ruby Net::HTTP, URI.parse, open-uri, HTTParty, Faraday, RestClient;
assigned to a name or key that says it is an endpoint (url, uri, endpoint, host, server, base, api, webhook, callback, origin, proxy, registry, gateway, service, upstream, redirect);
loaded by a <script> or <iframe> src.

Not reported: hyperlinks (href, link helpers), URLs in comments, licence headers and prose strings, lists of URLs with no endpoint context (such as redirect allowlists), XML/JSON-schema namespace and SAX feature identifiers, the bare scheme in a prefix check or scheme list, loopback, private-range and reserved example hosts, a normaliser listing both the http and https form of one host, test code, and example, sample and demo directories.

Why This Matters

Anything sent over plain HTTP or FTP (credentials, tokens, personal data, the response itself) can be read and modified by anyone on the network path: public Wi-Fi, a compromised router, an ISP. A script loaded over HTTP can be replaced with an attacker’s.

What Gets Flagged

# FLAGGED
resp = requests.post("http://payments.partner-bank.com/v1/charge", json=payload)
BASE_URL = "http://api.weather-provider.net"

// FLAGGED
export const API_URL = 'http://api.shop-backend.com';
await axios.post("http://hooks.notify-service.net/events", event);

// FLAGGED
return http.Get("http://status.cloud-vendor.io/health")

Not flagged: '<li><a href="http://partner-site.com/">Partner</a></li>', factory.setFeature("http://xml.org/sax/features/external-general-entities", false), http.Get("http://localhost:8080/health").

Remediation

Use https:// (or SFTP/FTPS) for every remote endpoint and keep certificate verification on.
Load scripts and frames over HTTPS, ideally with Subresource Integrity.
Enable HSTS on services you control so clients never fall back to HTTP.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-319
// nosec vnx-319

Or record an ignore rule: vulnetix ignore add --rule vnx-319 --reason "...". See Suppressing findings.