VNX-499: Serializable Class Containing Sensitive Data

Detects non-transient secret fields (password, token, API key, private key, card number) in Java classes that implement Serializable and do not control their serial form.

Field	Value
Rule ID	`VNX-499`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	Java
CWE	CWE-499
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`serializable-sensitive` `cwe-499`
Source	`internal/sast/rules/vnx-499.rego`

Overview

VNX-499 maps to CWE-499: Serializable Class Containing Sensitive Data. Default Java serialisation writes every non-transient field into the byte stream. When the object ends up in an HTTP session store, a cache, a file or an RMI call, the secret travels with it in recoverable form.

The rule reports a field of a class that implements Serializable (the clause may span lines) when the field is neither transient nor static and holds a secret: a String, char[], byte[] or CharSequence whose name says password, passphrase, pwd, pin, secret, API key, private key, an access/refresh/auth/session/bearer/id/csrf token, credential, credit card or card number, CVV or SSN, or a field of type PrivateKey, SecretKey, SecretKeySpec, KeyPair, KeyStore or Key.

What Gets Flagged

public class UserAccount implements Serializable {
    private String username;
    private String password;      // FLAGGED
    private char[] pin;           // FLAGGED

public class OAuthSession extends BaseSession implements Comparable<OAuthSession>, Serializable {
    private String accessToken;   // FLAGGED
    private PrivateKey signingKey; // FLAGGED

What Is Not Flagged

transient and static fields (private static final String PASSWORD_PARAM = "password").
Names that describe a secret rather than hold it (passwordPolicy, tokenEndpoint) and non-text types (int passwordLength).
Classes that control their serial form: writeObject, writeReplace, serialPersistentFields or Externalizable.
Classes that are not Serializable, test code, comments and string literals.

Classes that become serialisable only through a superclass are not resolved.

Remediation

Mark the field transient and re-obtain the secret after deserialisation.
Or define writeObject/writeReplace so the secret is excluded, or throw NotSerializableException.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-499
// nosec vnx-499

Or record an ignore rule: vulnetix ignore add --rule vnx-499 --reason "...". See Suppressing findings.