VNX-555: J2EE Misconfiguration: Plaintext Password in Configuration File

A literal password is written into a Java EE / Jakarta EE deployment descriptor or application-server configuration file (web.xml, context.xml, server.xml, tomcat-users.xml, persistence.xml, *-ds.xml and similar).

Field	Value
Rule ID	`VNX-555`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, XML
CWE	CWE-555
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`j2ee-credentials` `plaintext-password` `cwe-555`
Source	`internal/sast/rules/vnx-555.rego`

Overview

VNX-555 maps to CWE-555: J2EE Misconfiguration: Plaintext Password in Configuration File. It reads Java EE deployment descriptors and application-server configuration and reports passwords written there in plain text.

Why This Matters

Descriptors are packaged into the WAR or EAR, committed to the repository and copied to every server. Anyone who can read one of those copies has the database, LDAP or SMTP credential, and rotating it means rebuilding and redeploying.

What Gets Flagged

Files: web.xml, context.xml, server.xml, tomcat-users.xml, persistence.xml, ejb-jar.xml, application.xml, ra.xml, WildFly standalone*.xml/domain.xml/host.xml/*-ds.xml, GlassFish glassfish-resources.xml, weblogic*.xml, jboss*.xml, jetty*.xml, resin.xml, ibm-*.xml, hibernate.cfg.xml.

<Resource name="jdbc/AppDB" type="javax.sql.DataSource"
          username="app" password="S3cure!Pass"/>                                  <!-- FLAGGED -->
<user username="admin" password="tomcat123" roles="manager-gui"/>                 <!-- FLAGGED -->
<property name="jakarta.persistence.jdbc.password" value="Pr0dPassw0rd"/>         <!-- FLAGGED -->
<password>0racleApp</password>                                                    <!-- FLAGGED -->

<context-param>
  <param-name>dbPassword</param-name>
  <param-value>Winter2024!</param-value>                                          <!-- FLAGGED -->
</context-param>

Not flagged: empty values, references such as ${db.password} and #{env.DB_PASSWORD}, encoded values ({aes}..., {xor}..., ENC(...)), masks and placeholder words, names that only contain the word (hibernate.password.encoder), XML comments, other XML files, .example/.sample/.template copies and test resources. VNX-260 reports passwords in configuration files generally and leaves the lines this rule reports in these files to it; VNX-SEC-014 reports password="..." attributes.

Remediation

Define the data source or realm on the server with its credential store (Tomcat ${...} property substitution, WildFly Elytron credential stores, WebSphere/WebLogic encrypted aliases) and reference it by JNDI name.
Read secrets from environment variables or a secrets manager at deploy time.
Rotate every password that was committed.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-555
// nosec vnx-555

Or record an ignore rule: vulnetix ignore add --rule vnx-555 --reason "...". See Suppressing findings.