VNX-521: Weak Password Requirements

Detects password policies in code that accept passwords shorter than 8 characters: length checks on password values, minimums declared on password fields (Joi/zod/yup, express-validator, jQuery Validate, Mongoose, @Size, C# StringLength/MinLength, ASP.NET Identity RequiredLength, Django MinimumLengthValidator) and an empty Django AUTH_PASSWORD_VALIDATORS.

Field	Value
Rule ID	`VNX-521`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python, C#
CWE	CWE-521
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`password-policy` `cwe-521`
Source	`internal/sast/rules/vnx-521.rego`

Overview

VNX-521 maps to CWE-521: Weak Password Requirements. NIST SP 800-63B and OWASP ASVS 2.1.1 require passwords of at least 8 characters. The rule reports a minimum between 2 and 7 written into code:

a length comparison on a password-named value: len(password) < 6, password.length < 6, password.length() < 6, password.Length < 6;
a minimum declared on a password field: Joi/zod/yup .min(N), express-validator isLength({ min: N }), jQuery Validate or Mongoose minlength under a password key, Java @Size/@Length(min = N) on a password field, ASP.NET Identity options.Password.RequiredLength = N, Django MinimumLengthValidator min_length;
a Django AUTH_PASSWORD_VALIDATORS = [], which disables every check.

What Gets Flagged

if len(password) < 6:                                  # FLAGGED
    raise forms.ValidationError("Password too short")

password: Joi.string().min(4).required(),              // FLAGGED
body("password").isLength({ min: 5 }),                 // FLAGGED

@Size(min = 4, max = 64)                               // FLAGGED
private String password;

[StringLength(64, MinimumLength = 6)]                  // FLAGGED
[DataType(DataType.Password)]
public string Password { get; set; }

What Is Not Flagged

Minimums of 8 or more, a minimum of 0 or 1 (a presence check such as z.string().min(1, "Password is required") on a login form), maximum-length checks (password.length() > 30), minimums on other fields, the numbers inside messages, comments, strings, minified files and test code. Policies configured outside the code (an identity provider, a directory) are not seen.

Remediation

Require at least 8 characters (12 or more is better) and allow long passphrases (at least 64 characters).
Check new passwords against a list of breached and common passwords.
For Django, keep MinimumLengthValidator (with min_length of 8 or more) and CommonPasswordValidator in AUTH_PASSWORD_VALIDATORS.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-521
// nosec vnx-521

Or record an ignore rule: vulnetix ignore add --rule vnx-521 --reason "...". See Suppressing findings.