VNX-472: External Control of Assumed-Immutable Web Parameter

Reports server-owned values taken from the client: a price, total, discount or privilege field (role, isAdmin) read from the request body, query, params or cookies in JavaScript/TypeScript, and hidden form inputs in templates that carry a price, privilege or user id. Admin back-office routes, price fields that are only compared, user-chosen fields such as amount or quantity, CSRF tokens, tests and comments are not reported.

Field	Value
Rule ID	`VNX-472`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, HTML
CWE	CWE-472
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`externally-controllable-web-param` `cwe-472`
Source	`internal/sast/rules/vnx-472.rego`

Overview

VNX-472 maps to CWE-472: External Control of Assumed-Immutable Web Parameter. Reports server-owned values taken from the client: a price, total, discount or privilege field (role, isAdmin) read from the request body, query, params or cookies in JavaScript/TypeScript, and hidden form inputs in templates that carry a price, privilege or user id. Admin back-office routes, price fields that are only compared, user-chosen fields such as amount or quantity, CSRF tokens, tests and comments are not reported.

Why This Matters

This weakness class (External Control of Assumed-Immutable Web Parameter) creates a concrete exploit surface: the rule searches for the concrete source-level patterns most commonly associated with CWE-472 and surfaces them for review. Each finding should be evaluated in context, the rule catches the pattern, not the context.

What Gets Flagged

// FLAGGED: the client sets the price it pays
price: req.body.price,

// FLAGGED: the client claims its own privilege
if (req.cookies.isAdmin === 'true') { return next(); }

// NOT FLAGGED: the submitted price is only validated against the server's
if (req.body.price !== product.price) { return res.status(400).end(); }

<!-- FLAGGED: a hidden input is not read-only -->
<input type="hidden" name="price" value="<%= item.price %>">

Remediation

Review each flagged line and determine whether the pattern represents a real instance of CWE-472 or a false positive.
Replace the flagged construct with a documented safe alternative appropriate to your language and framework.
For confirmed false positives, add a # vulnetix-ignore: VNX-472 comment on the line.
Ensure equivalent test coverage exists to prevent regression.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-472
// nosec vnx-472

Or record an ignore rule: vulnetix ignore add --rule vnx-472 --reason "...". See Suppressing findings.