VNX-524: Use of Cache Containing Sensitive Information: plaintext password cached

Detects plaintext passwords put into a cache: lru_cache/cache/@cached/@memoize/@Cacheable/memoize() on a function that takes a password, and cache/redis/memcache writes (set, setex, put, hset...) whose key or value is a password variable or a request's password field.

Field	Value
Rule ID	`VNX-524`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, JavaScript / TypeScript, Python
CWE	CWE-524
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`cache-sensitive` `password` `cwe-524`
Source	`internal/sast/rules/vnx-524.rego`

Overview

VNX-524 maps to CWE-524: Use of Cache Containing Sensitive Information. A password in a cache outlives the request, is shared with everything else that can read the cache (another tenant, a debug endpoint, a Redis or memcached dump), and a memoised credential check keeps succeeding after the password is changed. The rule reports:

Python functools.lru_cache/cache, cachetools @cached and @memoize on a function with a password parameter;
Java Spring @Cacheable on a method with a password parameter;
lodash/memoizee memoize() of a function with a password parameter;
a cache write (cache, redis, memcache, lru receivers: set, setex, add, put, hset, set_many) whose key or value is a password variable or a request’s password field.

What Gets Flagged

@functools.lru_cache(maxsize=1024)               # FLAGGED
def check_credentials(username: str, password: str) -> bool:
    return ldap_bind(username, password)

cache.set(f"signup:{key}", password, timeout=600)  # FLAGGED

@Cacheable("logins")                             // FLAGGED
public User login(String username, String password) { ... }

What Is Not Flagged

Password hashes and digests (password_hash, hashedPassword), tokens and other values, flags and messages about passwords (password_reset_sent, passwordChangedAt), cached functions without a password parameter, comments and test code. Model attributes such as user.password are not followed, since they usually hold the hash.

Remediation

Never cache credential checks or the passwords themselves.
When a multi-step flow needs state, cache an opaque reference or a hash, never the password.
If authentication results must be cached, key them by a session identifier and invalidate them on password change.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-524
// nosec vnx-524

Or record an ignore rule: vulnetix ignore add --rule vnx-524 --reason "...". See Suppressing findings.