VNX-523: Unprotected Transport of Credentials

Detects credentials sent to a remote host over plain http://: URLs with a user:password pair, HTTP client calls to http:// URLs that carry auth=, an Authorization header or a password/token field, requests built on http:// that get SetBasicAuth or an Authorization header, and login forms that post to an http:// action.

Field	Value
Rule ID	`VNX-523`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Go, Java, JavaScript / TypeScript, Python, HTML
CWE	CWE-523
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:A/AL:A/IC:N/FC:LT/RP:N/RL:A/AV:I/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`unprotected-transport` `cleartext` `credentials` `cwe-523`
Source	`internal/sast/rules/vnx-523.rego`

Overview

VNX-523 maps to CWE-523: Unprotected Transport of Credentials. Credentials sent over plain HTTP can be read and replayed by anyone on the network path. The rule reports, for remote hosts only:

a URL that embeds credentials: http://user:pass@host;
an HTTP client call to an http:// URL whose arguments carry credentials: Python requests/httpx/session/urllib3 with auth=, an Authorization/Cookie/X-Api-Key header, or a password, token or API-key field; fetch/axios/jQuery with the same in their options; Go http.PostForm with a password field;
a request built on an http:// URL (Go http.NewRequest, Java new URL, URI.create, new HttpGet/HttpPost) that is given SetBasicAuth or an Authorization header within the next eight lines;
an HTML login form (a page with a password input) whose action is an http:// URL.

What Gets Flagged

requests.get("http://orders.acme-corp.com/api/orders", auth=(user, password))  # FLAGGED

req, err := http.NewRequest("GET", "http://inventory.acme-corp.com/items", nil) // FLAGGED
req.SetBasicAuth(user, pass)

<form method="post" action="http://accounts.acme-corp.com/login">  <!-- FLAGGED -->

What Is Not Flagged

https:// URLs; loopback, private-range, link-local and single-label hosts (localhost, 127.0.0.1, 10.x, cache:6379); reserved names (example.com, .test, .local, .internal); requests that carry no credentials (a message such as json={"text": "Password reset requested"} is prose, not a credential); URLs in comments or prose strings; and test code. Cleartext endpoints in general are VNX-319, and cleartext redis/amqp/ftp/ldap connection URLs are VNX-SEC-017.

Remediation

Use https:// for every request that carries a password, token, cookie or API key, and for every login form action.
Enable HSTS on the server so browsers never fall back to HTTP.
Keep credentials out of URLs entirely; send them in an Authorization header over TLS.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-523
// nosec vnx-523

Or record an ignore rule: vulnetix ignore add --rule vnx-523 --reason "...". See Suppressing findings.