VNX-454: External Initialization of Trusted Variables or Data Stores

Field	Value
Rule ID	VNX-454
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Python
CWE	CWE-454
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	external-initialization cwe-454 access-control
Source	internal/sast/rules/vnx-454.rego

Overview

VNX-454 maps to CWE-454: External Initialization of Trusted Variables or Data Stores. It reports Python web code that initialises authorisation state from values the client controls: a cookie or header whose key names a privilege or authentication state (admin, is_admin, role, permissions, logged_in, X-User-Role…), a query or form parameter with such a key tested in an if, a session key of that kind assigned from request data, and a trust-flag variable (is_admin, g.authenticated) assigned from a cookie, header or query parameter, directly or through a variable a few lines above. Server-side state (request.user, current_user, session.get, a database user), lookalike keys such as admin_email, and settings read from os.environ are not reported.

Why This Matters

A privilege the client can set is a privilege the client can grant itself: sending Cookie: admin=1 or X-User-Role: admin is enough to pass the check.

What Gets Flagged

# FLAGGED: privilege read from a header into a trust flag
is_admin = request.headers.get("X-Is-Admin")

# FLAGGED: session role set from the request
session["role"] = request.form["role"]

# NOT FLAGGED: privilege taken from the authenticated user
if request.user.is_staff:
    ...

# Reported by VNX-784, not VNX-454: a security decision on a cookie
if request.COOKIES.get("admin") == "1":
    return render(request, "admin.html")

A privilege or login-state cookie that is compared or tested on its line, or assigned to a variable that a condition uses within 15 lines, is a security decision on a cookie. VNX-784 reports it, so VNX-454 does not report it again.

Remediation

1. Derive privileges from server-side state: the authenticated user record, a signed session written by the server, or a permission lookup.
2. Never trust a cookie, header or parameter that names a role or flag; treat it as a request, not a fact.
3. For confirmed false positives, add a # vulnetix-ignore: VNX-454 comment on the line.

References

• CWE-454: External Initialization of Trusted Variables or Data Stores
• OWASP Top 10

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-454
// nosec vnx-454

Or record an ignore rule: vulnetix ignore add --rule vnx-454 --reason "...". See Suppressing findings.