VNX-492: Use of Inner Class Containing Sensitive Data

A Java inner class (a non-static member class, or an anonymous class created with new X() { ... }) reads a private field of its outer class whose name says it holds a password, passphrase, secret, API key, token, credential, private, master, signing, encryption or HMAC key, or PIN. Inner classes compile to separate top-level classes, so the compiler (before Java 11 nestmates) widens access to the outer class's private field through package-visible accessors any class in the package can call, and the inner instance keeps the outer instance, and the secret, reachable. Reported at the inner class's declaration. Not reported: static nested classes, inner classes that do not use a sensitive field, lambdas, sensitive fields that are not private, test code and comments.

Field	Value
Rule ID	`VNX-492`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-492
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`inner-class` `sensitive-data` `cwe-492`
Source	`internal/sast/rules/vnx-492.rego`

Overview

VNX-492 maps to CWE-492: Use of Inner Class Containing Sensitive Data. It reports inner and anonymous classes that use a private sensitive field of the class that contains them.

Why This Matters

The JVM has no notion of an inner class. Before Java 11, javac gave an inner class access to its outer class’s private fields by generating package-visible accessor methods, which any class in the same package can call. The inner object also holds a hidden reference to the outer one, so passing it to other code (a callback, an interceptor) keeps the secret reachable.

What Gets Flagged

public class Vault {
    private char[] masterPassword;

    class Unlocker {                          // FLAGGED
        boolean unlock(char[] attempt) {
            return Arrays.equals(attempt, masterPassword);
        }
    }
}

private String sessionToken;

Runnable refresher() {
    return new Runnable() {                   // FLAGGED
        public void run() { sessionToken = renew(sessionToken); }
    };
}

Not flagged: a static class nested class, and inner classes that only touch non-sensitive fields.

Remediation

Make the nested class static and pass it only the data it needs.
Keep the operation on the secret in the outer class and give the inner class a method to call instead of the field.
Compile for Java 11 or later, where nestmate access removes the synthetic accessors.

References

CWE-492: Use of Inner Class Containing Sensitive Data

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-492
// nosec vnx-492

Or record an ignore rule: vulnetix ignore add --rule vnx-492 --reason "...". See Suppressing findings.