VNX-348: Use of Less Trusted Source

Field	Value
Rule ID	VNX-348
Severity	Medium
SARIF level	warning
Kind	sast
Languages	C#, Go, Java, Kotlin, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-348
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	ip-source cwe-348
Source	internal/sast/rules/vnx-348.rego

Overview

VNX-348 maps to CWE-348: Use of Less Trusted Source. It reports code that prefers a client-written address header over the address the server actually saw: a read of X-Forwarded-For, X-Real-IP, X-Client-IP, True-Client-IP, CF-Connecting-IP or X-Cluster-Client-IP (or the CGI/PHP spelling HTTP_X_FORWARDED_FOR, HTTP_CLIENT_IP) that falls back, on the same line or within the next ten lines, to the socket address (REMOTE_ADDR, remote_addr, remoteAddress, getRemoteAddr(), RemoteAddr, RemoteIpAddress, req.ip, Laravel $request->ip(), Symfony getClientIp()).

Why This Matters

The fallback is the mark of code that does not know whether a proxy is in front of it. Without a proxy that strips the header, any client sends X-Forwarded-For: 127.0.0.1 and chooses the address an allowlist checks, a rate limiter keys on, or an audit log records. Even behind a proxy, the leftmost X-Forwarded-For entry is whatever the client sent.

Not reported: the rightmost hop (split(",")[-1], rsplit, .pop()), a read guarded by a trusted-proxy check in the three lines above, a proxy setting, deleting or appending the header for the next hop, a header that is only logged, reads with no socket-address fallback, comments and prose. A rate limiter key function that reads the header (keyGenerator, key_func, keyResolver on the read line or up to two lines above it) in Python, Java or JavaScript/TypeScript is reported by VNX-290, which names the brute-force consequence, so this rule does not report the same read again.

What Gets Flagged

x_forwarded_for = request.META.get("HTTP_X_FORWARDED_FOR")
if x_forwarded_for:
    ip = x_forwarded_for.split(",")[0]
else:
    ip = request.META.get("REMOTE_ADDR")

$ip = isset($_SERVER['HTTP_X_FORWARDED_FOR']) ? $_SERVER['HTTP_X_FORWARDED_FOR'] : $_SERVER['REMOTE_ADDR'];

keyGenerator({ headers, ip }: any) { return headers["X-Forwarded-For"] ?? ip },

Remediation

1. Use the socket address unless the deployment always has a proxy in front.
2. Behind a known proxy, use the framework’s trusted-proxy support (Express trust proxy, Django/Werkzeug ProxyFix, Rails trusted_proxies, ASP.NET ForwardedHeadersOptions.KnownProxies, gin SetTrustedProxies) or take the rightmost entry that your proxy appended.

References

• CWE-348: Use of Less Trusted Source
• MDN: X-Forwarded-For security and privacy concerns

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-348
// nosec vnx-348

Or record an ignore rule: vulnetix ignore add --rule vnx-348 --reason "...". See Suppressing findings.