VNX-346: Origin Validation Error

Field	Value
Rule ID	VNX-346
Severity	Medium
SARIF level	warning
Kind	sast
Languages	JavaScript / TypeScript, Python, Java, Go
CWE	CWE-346
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	origin-validation csrf cwe-346 cors
Source	internal/sast/rules/vnx-346.rego

Overview

VNX-346 maps to CWE-346: Origin Validation Error. It reports origin checks that a hostile site can satisfy, in JavaScript/TypeScript, Python, Java and Go:

• a substring test of the origin: indexOf/includes/contains/search, Python "x" in origin, Go strings.Contains/strings.Index, against a domain literal or a variable (referer.contains(host));
• a prefix test (startsWith, startswith, strings.HasPrefix) against a domain literal that does not end in /;
• a suffix test (endsWith, endswith, strings.HasSuffix) against a domain literal without a leading dot;
• a regular expression applied to the origin that is not anchored at the end (re.match/re.search, /re/.test(), .match());
• a gorilla/websocket CheckOrigin function that only returns true.

The origin is an identifier named origin/referer/referrer (event.origin, req.headers.origin, document.referrer, also through optional chaining such as req.headers.origin?.includes(...)), a header read of Origin/Referer, or a variable of any name assigned directly from one of those in the 10 lines above (const sender = event.origin). A substring test whose argument is a concatenation (origin.includes('://' + host)) is reported too.

Why This Matters

https://example.com.evil.net contains, and starts with, https://example.com; https://evilexample.com ends with example.com. A check of that shape lets any site the attacker registers through a CORS policy that sends credentials, a postMessage handler, a Referer-based CSRF defence or a WebSocket upgrade.

Not reported: exact comparisons and allow-list membership (ALLOWED.has(origin), allowedOrigins.includes(origin), origin in ALLOWED), anchored regular expressions and re.fullmatch, suffixes with a leading dot, scheme checks (startsWith('https://')), parsed host comparisons, comments and string literals. Wildcard and reflected CORS headers are VNX-SEC-012’s concern; a message listener that never checks the origin is VNX-NODE-024’s.

What Gets Flagged

if (!origin || origin.indexOf("example.com") !== -1) return callback(null, true);
if (!e.origin.endsWith("example.org")) return;

if "example.com" in origin:
    resp.headers["Access-Control-Allow-Origin"] = origin

return referer != null && referer.contains(host);

var upgrader = websocket.Upgrader{
	CheckOrigin: func(r *http.Request) bool { return true },
}

Remediation

1. Compare the whole origin exactly against an allow-list (ALLOWED.has(origin)).
2. To accept subdomains, parse the origin and test the host for equality with the apex or a suffix that starts with a dot (host.endswith(".example.com")).
3. Anchor any regular expression at both ends, and escape the dots.

References

• CWE-346: Origin Validation Error
• OWASP: Cross-Site WebSocket Hijacking

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-346
// nosec vnx-346

Or record an ignore rule: vulnetix ignore add --rule vnx-346 --reason "...". See Suppressing findings.