VNX-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere

Field	Value
Rule ID	VNX-497
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java
CWE	CWE-497
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	information-exposure-system cwe-497
Source	internal/sast/rules/vnx-497.rego

Overview

VNX-497 maps to CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere. The JVM version, operating system, install paths, environment variables and host name tell an attacker which exploits to try and where files live. The rule reports these values when they leave the server in an HTTP response.

Sources: System.getProperty() of a platform key (os.name, os.version, os.arch, java.version, java.vendor, java.home, java.class.path, java.library.path, java.io.tmpdir, java.vm.*, user.home, user.dir, user.name, sun.*), System.getenv(), System.getProperties(), InetAddress.getLocalHost() and ManagementFactory MXBeans.

Sinks: response.getWriter() / getOutputStream() print, println, write, append, printf and format; a writer variable (out, writer, pw) in a file that obtains the response writer; ResponseEntity.ok() / .body(); a return from a @*Mapping handler in a @RestController or @ResponseBody class; Model.addAttribute() / ModelAndView.addObject(); JSP <%= %> and out.print.

The source may be in the sink’s argument or assigned within the 25 lines above, with one intermediate assignment.

What Gets Flagged

// FLAGGED
response.getWriter().println("Java: " + System.getProperty("java.version"));

// FLAGGED: two-line form
String host = InetAddress.getLocalHost().getHostName();
resp.getWriter().append("host=").append(host);

// FLAGGED: REST handler returns the environment
@GetMapping("/status/env")
public ResponseEntity<Map<String, String>> env() {
    return ResponseEntity.ok(System.getenv());
}

What Is Not Flagged

• Logging (LOG.info("Starting on Java " + System.getProperty("java.version"))) and console output (System.out.println).
• Using the value internally: building a path from user.home, branching on os.name.
• Application-defined properties (System.getProperty("acme.mode")).
• The patterns in comments or string literals.

Stack traces and exception messages written to the client are a separate weakness (CWE-209).

Remediation

1. Remove system details from responses; a version banner helps attackers more than users.
2. If operators need the information, expose it on an authenticated admin endpoint or in logs.

References

• CWE-497
• OWASP Top 10 A05: Security Misconfiguration

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-497
// nosec vnx-497

Or record an ignore rule: vulnetix ignore add --rule vnx-497 --reason "...". See Suppressing findings.