VNX-600: Servlet parses request input with no handler for the exception

Field	Value
Rule ID	VNX-600
Severity	Medium
SARIF level	warning
Kind	sast
Languages	Java
CWE	CWE-600
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	java servlet exception-handling error-handling cwe-600
Source	internal/sast/rules/vnx-600.rego

Overview

VNX-600 maps to CWE-600: Uncaught Exception in Servlet. The rule looks inside servlet handlers (doGet, doPost, doPut, doDelete, doHead, doOptions, doTrace or service taking an HttpServletRequest) and JSP scriptlets for a conversion of request input: Integer/Long/Short/Double/Float parse* or valueOf, new BigDecimal, new BigInteger, UUID.fromString, or LocalDate/LocalDateTime/Instant.parse. The argument must be a request read (getParameter, getHeader, getQueryString, getPathInfo…) or a variable assigned from one within the 15 lines above, and the conversion must sit outside any try block.

It does not report conversions inside a try, in a helper method that handles the exception itself, of constants or of non-request data (properties, argv), code outside servlet handlers, or comments and string literals. Exceptions thrown by deeper calls are not traced.

Why This Matters

A NumberFormatException or IllegalArgumentException that escapes the servlet becomes a 500 response. Depending on the container’s error page configuration it carries a stack trace with class names, library versions and file paths, and the attacker can trigger it at will by sending ?id=x.

What Gets Flagged

protected void doGet(HttpServletRequest request, HttpServletResponse response)
        throws ServletException, IOException {
    int id = Integer.parseInt(request.getParameter("id"));   // FLAGGED
}

String ref = req.getHeader("X-Order-Ref");
UUID orderId = UUID.fromString(ref);                          // FLAGGED

// NOT FLAGGED
try {
    int id = Integer.parseInt(request.getParameter("id"));
} catch (NumberFormatException e) {
    response.sendError(HttpServletResponse.SC_BAD_REQUEST, "bad id");
}

Remediation

1. Catch the conversion exception and answer 400 Bad Request.
2. Validate the input format before converting it.
3. Configure a generic error page (<error-page> in web.xml) so no unhandled exception shows a stack trace.

References

• CWE-600: Uncaught Exception in Servlet
• OWASP: Improper Error Handling

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-600
// nosec vnx-600

Or record an ignore rule: vulnetix ignore add --rule vnx-600 --reason "...". See Suppressing findings.