VNX-548: Exposure of Information Through Directory Listing

Detects directory listing switched on: serve-index in Node, Django show_indexes, aiohttp show_index and Flask-AutoIndex in Python, Tomcat listings and Jetty dirAllowed/setDirectoriesListed in Java, @fastify/static list: true, nginx autoindex on and Apache Options Indexes or All.

Field	Value
Rule ID	`VNX-548`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	JavaScript / TypeScript, Python, Java, Any file
CWE	CWE-548
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`directory-listing` `cwe-548`
Source	`internal/sast/rules/vnx-548.rego`

Overview

VNX-548 maps to CWE-548: Exposure of Information Through Directory Listing. A server that answers a request for a directory with a list of its files lets anyone enumerate backups, logs, uploads and keys that were never linked. The rule reports:

JavaScript/TypeScript: a serveIndex(...) call (the serve-index middleware), and @fastify/static registered with list: true;
Python: Django’s static serve view with "show_indexes": True or static(..., show_indexes=True), aiohttp add_static(..., show_index=True), Flask-AutoIndex AutoIndex(app, ...);
Java: a Tomcat listings or Jetty dirAllowed init-param set to true in web.xml, Jetty setDirectoriesListed(true) and setInitParameter("dirAllowed", "true");
nginx autoindex on; (also inside a one-line location block) and Apache Options Indexes / Options +Indexes / Options All in .conf files, sites-available/sites-enabled and .htaccess.

What Gets Flagged

app.use('/ftp', express.static('ftp'), serveIndex('ftp', { icons: true }));  // FLAGGED

location /downloads/ {
    autoindex on;   # FLAGGED
}

What Is Not Flagged

Importing serve-index without calling it, and file servers that do not list directories (express.static).
The settings switched off: autoindex off, Options -Indexes, listings false, show_indexes: False, setDirectoriesListed(false).
Commented-out directives, string literals and test files.

Go’s http.FileServer lists any directory without an index.html; it is not reported because nearly every use serves a directory of public assets on purpose.

Remediation

Turn directory listing off and serve only the files that are meant to be public. Put downloadable files behind an explicit index page or an authenticated handler.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-548
// nosec vnx-548

Or record an ignore rule: vulnetix ignore add --rule vnx-548 --reason "...". See Suppressing findings.