VNX-651: Exposure of WSDL File Containing Sensitive Information

Reports a WSDL or XSD that publishes a credential value, a credentialed endpoint address or a debug/internal operation, and JAX-WS, spyne and WCF service methods with such names that end up in the generated WSDL.

Field	Value
Rule ID	`VNX-651`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Java, Python, C#, XML
CWE	CWE-651
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`wsdl` `soap` `information-exposure` `cwe-651`
Source	`internal/sast/rules/vnx-651.rego`

Overview

VNX-651 maps to CWE-651: Exposure of WSDL File Containing Sensitive Information. A WSDL is handed to every client that asks for ?wsdl. The rule reports what it should not contain:

In .wsdl and .xsd files: an element or attribute whose name ends in a credential word (adminPassword, client_secret, apiKey, token, privateKey) with a non-empty default= or fixed= value that is not a number, a boolean or Bearer, and a soap:address/soap12:address/http:address location with user:password@ in it.
An operation named like a back door: debug*, internal*, dump*, backdoor*, hidden*, exec/execute/run + Command/Shell/Sql/Script/Query, and get*Password/Secret/PrivateKey/Credentials.
The same names on code that generates the WSDL: a Java @WebMethod, a Python spyne @rpc/@srpc, a C# WCF [OperationContract].

Not reported: ordinary operations (changePassword, getPasswordPolicy, testConnection, executeOrder), credential elements without a value, settings that only describe a credential (tokenType, passwordMinLength), https or credential-free addresses, @WebMethod(exclude = true), methods without the service annotation, comments and string literals.

Why This Matters

A WSDL is a map of the service. An operation left in it for debugging tells an attacker exactly which call dumps sessions or runs SQL, and a default password in the schema is a password published to anyone.

What Gets Flagged

<!-- FLAGGED -->
<xs:element name="adminPassword" type="xs:string" default="Winter2024!"/>
<soap:address location="http://svc_admin:S3cretPass@10.0.4.12:8080/account"/>
<operation name="debugDumpSessions">

@WebMethod
public String internalResetCache(String region) {   // FLAGGED

@rpc(_returns=Unicode)
def dump_all_tokens(ctx):                            # FLAGGED

Remediation

Remove debug and internal operations from the published contract (@WebMethod(exclude = true), a separate internal endpoint) or protect them with authentication.
Never put credential values in a schema default/fixed or an endpoint address.
Restrict who can fetch the WSDL in production when the service is not public.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-651
// nosec vnx-651

Or record an ignore rule: vulnetix ignore add --rule vnx-651 --reason "...". See Suppressing findings.