VNX-419: Unprotected Primary Channel

Reports an administrative or management interface served over a plaintext network listener: Go http.ListenAndServe, Server.ListenAndServe/Serve and net.Listen naming an admin/management/mgmt address, handler or server, and Java/Kotlin ServerSocket, ServerSocketChannel and HttpServer.create for one. TLS listeners, loopback (including a Go address variable assigned only loopback literals) and Unix-socket listeners, non-admin listeners and test code are not reported.

Field	Value
Rule ID	`VNX-419`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Go, Java, Kotlin
CWE	CWE-419
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`unprotected-primary-channel` `cleartext` `admin-interface` `cwe-419`
Source	`internal/sast/rules/vnx-419.rego`

Overview

VNX-419 maps to CWE-419: Unprotected Primary Channel. An administration channel carries the most powerful credentials and commands a service accepts. Served in plaintext on a network interface, anyone on the path can read the admin’s password or session and replay its commands.

Reported:

Go: http.ListenAndServe(addr, handler) whose address or handler names an admin, management or mgmt interface; X.ListenAndServe() or X.Serve(ln) where X is so named, or is an http.Server literal whose Addr or Handler is; net.Listen("tcp", addr) with an admin address whose listener is not wrapped by tls.NewListener.
Java and Kotlin: new ServerSocket(...), ServerSocketChannel.open().bind(...) and HttpServer.create(...) whose variable, port or address names an admin or management interface.

What Gets Flagged

log.Fatal(http.ListenAndServe(":9090", adminMux))   // FLAGGED

try (ServerSocket adminSocket = new ServerSocket(adminPort)) {   // FLAGGED

val managementServer = HttpServer.create(InetSocketAddress(config.managementPort), 0)   // FLAGGED

What Is Not Flagged

ListenAndServeTLS, ServeTLS, tls.NewListener, SSLServerSocket, HttpsServer.
Listeners bound to 127.0.0.1, localhost, [::1] or InetAddress.getLoopbackAddress(), and Unix sockets.
Listeners that do not name an administrative interface (an /admin route on the public listener is VNX-306’s concern), test files and comments.

Whether the admin handler also requires authentication is not judged.

Remediation

Serve the admin interface with TLS, or keep it off the network:

log.Fatal(http.ListenAndServeTLS(":9443", certFile, keyFile, adminMux))
// or
log.Fatal(http.ListenAndServe("127.0.0.1:9090", adminMux))

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-419
// nosec vnx-419

Or record an ignore rule: vulnetix ignore add --rule vnx-419 --reason "...". See Suppressing findings.