VNX-538: Insertion of Sensitive Information into Externally-Accessible File or Directory

Detects a password, secret, token, key, credential or the whole environment written into a web-served directory (public/, static/, www/, /var/www/) or a fixed /tmp path, in JavaScript/TypeScript and Python.

Field	Value
Rule ID	`VNX-538`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-538
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`sensitive-info-file-dir` `cwe-538`
Source	`internal/sast/rules/vnx-538.rego`

Overview

VNX-538 maps to CWE-538: Insertion of Sensitive Information into Externally-Accessible File or Directory. Files under a web root are served to anyone who asks for them, and a fixed path under /tmp is readable by every user on the host. This rule reports a write into such a location whose data is a secret.

It reports a file write (fs.writeFile/writeFileSync/appendFile/appendFileSync/createWriteStream; Python open(..., "w").write(), Path(...).write_text(), or fh.write()/json.dump(..., fh) inside with open(..., "w") as fh:) when:

the target names public/, static/, www/, htdocs/, wwwroot/, public_html/, /var/www/, a STATIC_DIR/PUBLIC_DIR/publicDir-style variable or a literal /tmp/ path, on the call line or through a variable assigned from one up to ten lines above, and
the data names a password, secret, token, API key, private key or credential, or dumps process.env/os.environ.

What Gets Flagged

// FLAGGED: the whole environment, served as /debug.json
fs.writeFileSync(path.join(__dirname, 'public', 'debug.json'), JSON.stringify(process.env));

# FLAGGED: database credentials written under the web root
with open("/var/www/html/backup/credentials.txt", "w") as fh:
    fh.write(f"{DB_USER}:{DB_PASSWORD}\n")

What Is Not Flagged

Non-sensitive data written to public directories (sitemaps, stats).
Secrets written to private paths, such as a file in the user’s config directory with mode 0600.
Reads from public directories, and names that only contain the words (tokenizer, secretary).
Comments, string literals and test files.

Whether a custom directory is web-served cannot be known statically and is not judged.

Remediation

Never persist secrets where the web server or other users can read them. Keep them in a secret store or environment, and if a file is unavoidable, write it outside the web root with restrictive permissions (fs.writeFileSync(file, token, { mode: 0o600 }), os.open(path, os.O_WRONLY | os.O_CREAT, 0o600)).

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-538
// nosec vnx-538

Or record an ignore rule: vulnetix ignore add --rule vnx-538 --reason "...". See Suppressing findings.