VNX-649: Client-held state decoded or decrypted and trusted without an integrity check

Field	Value
Rule ID	VNX-649
Severity	Medium
SARIF level	warning
Kind	sast
Languages	JavaScript / TypeScript, Python
CWE	CWE-649
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C
Tags	relying-integrity integrity-check cookie cwe-649
Source	internal/sast/rules/vnx-649.rego

Overview

VNX-649 maps to CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking. It reports two shapes in files that never verify integrity:

1. A request value decoded with base64, base64url or hex (base64.b64decode, Buffer.from(x, 'base64'), atob) and parsed (json.loads, pickle.loads, JSON.parse, .split(...)), on one line or through a variable a few lines apart.
2. A request value decrypted with AES in a malleable mode (AES.MODE_CBC cipher.decrypt, crypto.createDecipheriv('aes-256-cbc', ...)).

Why This Matters

Encoding is not protection, and encryption without a MAC is not integrity. A client decodes a base64 cookie, changes "role":"user" to "role":"admin" and encodes it again. With CBC or CTR it flips bits in the ciphertext to change the plaintext predictably, without knowing the key.

What Gets Flagged

prefs = json.loads(base64.b64decode(request.cookies["profile"]))

username = base64.b64decode(session_token).decode().split(':')[0]   # session_token from request.cookies

const session = JSON.parse(Buffer.from(req.cookies.session, 'base64').toString());
const couponData = Buffer.from(req.body.couponData, 'base64').toString().split('-')
const decipher = crypto.createDecipheriv('aes-256-cbc', KEY, buf.subarray(0, 16));

Not flagged: the same code in a file that checks an HMAC (hmac.compare_digest, crypto.timingSafeEqual), uses itsdangerous, Django signing, Fernet, JWT verification, signedCookies or AES-GCM with setAuthTag; HTTP Basic credentials decoded from the Authorization header; and decoded uploads that are stored rather than parsed.

Remediation

1. Keep security-relevant state on the server and give the client only an opaque random id.
2. If state must travel with the client, sign it (HMAC-SHA256, itsdangerous, cookie-parser with a secret) and verify the signature before parsing.
3. If it must also be confidential, use authenticated encryption (AES-GCM, ChaCha20-Poly1305, Fernet).

References

• CWE-649: Reliance on Obfuscation or Encryption of Security-Relevant Inputs without Integrity Checking
• OWASP Session Management Cheat Sheet

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-649
// nosec vnx-649

Or record an ignore rule: vulnetix ignore add --rule vnx-649 --reason "...". See Suppressing findings.