VNX-393: Return of Wrong Status Code

Field	Value
Rule ID	VNX-393
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-393
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	error-handling cwe-393
Source	internal/sast/rules/vnx-393.rego

Overview

VNX-393 maps to CWE-393: Return of Wrong Status Code. It reports, inside the body of a Java catch block, an HTTP success answer (return ResponseEntity.ok(...), ResponseEntity.status(HttpStatus.OK), new ResponseEntity<>(..., HttpStatus.OK), JAX-RS Response.ok(...), or setStatus(200)/setStatus(SC_OK)), and return true; in a boolean method whose name makes a security or validity decision (verify*, validate*, authenticate*, authorize*, checkPermission*/checkAccess*/checkSignature*/checkToken*/checkPassword*, hasPermission*, hasAccess*, canAccess*, isValid*, isAuthorized*, isAuthenticated*, isAllowed*, isPermitted*, isTrusted*, isVerified*, isSecure*, isSafe*, and names such as isTokenValid or isUserAllowed), which fails open. A return broken after ResponseEntity/Response (return ResponseEntity then .ok()) is read as one statement.

Not reported: a catch that returns an error status or false, return true from a method whose name is not such a decision (isRetryable, deleteQuietly) or is negated (isNotAllowed, which fails closed), success statuses outside a catch, test files and comments.

Why This Matters

The caller acts on the status. A transfer that failed but answered 200 is shown to the user as done; a signature check whose crypto threw and returned true accepts any forged token.

What Gets Flagged

} catch (InsufficientFundsException e) {
    return ResponseEntity.ok("transfer failed: " + e.getMessage());   // FLAGGED
}

public boolean verifySignature(byte[] payload, byte[] sig) {
    try {
        return s.verify(sig);
    } catch (GeneralSecurityException e) {
        return true;                                                  // FLAGGED: fails open
    }
}

Remediation

1. Return the error status that describes the failure (ResponseEntity.badRequest(), status(HttpStatus.INTERNAL_SERVER_ERROR), sendError).
2. A security decision must fail closed: return false or rethrow.

References

• CWE-393: Return of Wrong Status Code
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-393
// nosec vnx-393

Or record an ignore rule: vulnetix ignore add --rule vnx-393 --reason "...". See Suppressing findings.