VNX-618: ActiveX control marked safe for scripting, or unsafe control instantiated by a page

Reports ActiveX controls marked safe for scripting or initialisation (IObjectSafety, CATID_SafeForScripting, .rgs category GUIDs) and pages that instantiate command- or file-capable ActiveX objects.

Field	Value
Rule ID	`VNX-618`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	C, C++, HTML, JavaScript / TypeScript
CWE	CWE-618
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`exposed-unsafe-activex` `activex` `cwe-618`
Source	`internal/sast/rules/vnx-618.rego`

Overview

VNX-618 maps to CWE-618: Exposed Unsafe ActiveX Method. A control that tells the browser it is safe for scripting makes every one of its methods callable by any web page. The rule reports the places where that claim is made, and the pages that load a control whose methods run commands or touch the file system.

What Gets Flagged

public IObjectSafetyImpl<CLauncher, INTERFACESAFE_FOR_UNTRUSTED_CALLER | INTERFACESAFE_FOR_UNTRUSTED_DATA>,
*pdwEnabledOptions = INTERFACESAFE_FOR_UNTRUSTED_CALLER | INTERFACESAFE_FOR_UNTRUSTED_DATA;
IMPLEMENTED_CATEGORY(CATID_SafeForScripting)

'Implemented Categories'
{
    {7DD95801-9882-11CF-9FA9-00AA006C42C4}
}

var sh = new ActiveXObject("WScript.Shell");

<object id="shell" classid="clsid:72C24DD5-D70A-438B-8A42-98424B88AFB8"></object>

Not flagged: the flag and GUID definitions themselves (#define, DEFINE_GUID, extern declarations), a mask test in SetInterfaceSafetyOptions, ActiveX objects with no command or file capability (Msxml2.XMLHTTP, Microsoft.XMLDOM), media <object> embeds, comments and string literals.

Remediation

Do not mark a control safe for scripting unless every exposed method is safe with hostile arguments.
Restrict the control to approved sites (SiteLock) and remove methods that run commands or read and write files.
Replace page dependencies on WScript.Shell, Shell.Application, Scripting.FileSystemObject or ADODB.Stream with server-side code.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-618
// nosec vnx-618

Or record an ignore rule: vulnetix ignore add --rule vnx-618 --reason "...". See Suppressing findings.