VNX-656: Reliance on Security Through Obscurity

Reports a hidden request parameter, header or cookie compared to a hard-coded value whose branch grants access, or whose name is itself a privilege (admin, role, backdoor, bypass).

Field	Value
Rule ID	`VNX-656`
Severity	Low
SARIF level	`note`
Kind	`sast`
Languages	JavaScript / TypeScript, Python
CWE	CWE-656
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L`
Tags	`security-by-obscurity` `backdoor` `hidden-parameter` `cwe-656`
Source	`internal/sast/rules/vnx-656.rego`

Overview

VNX-656 maps to CWE-656: Reliance on Security Through Obscurity. It reports an if/elif that compares a request value (Python request.args/form/values/GET/POST/cookies/COOKIES/headers/query_params/json; JavaScript req.query/body/params/cookies/signedCookies/headers, req.get()/header()/param()), directly or through a variable assigned from one just above, with ==/=== to a non-empty string literal, when:

the branch grants access directly: return next()/next(), login()/login_user(), a session admin/user/role flag, is_admin = True, return True, a decorator returning the wrapped view; or
the parameter, header or cookie is named for a privilege: admin, is_admin, role, superuser, root, backdoor, bypass, override, god_mode, staff, privileged (optionally X- prefixed), unless the condition also checks the server-side user or session or is negated, or the branch rejects the request or only narrows a query filter (?role=admin in a user listing).

Not reported: comparisons whose branch only changes presentation (sort, format, language, theme), a grant behind a nested password/signature/timingSafeEqual check, secrets read from configuration or the environment, != comparisons, client-address and Referer/X-Forwarded-For checks (VNX-654), test files, comments and string literals.

Why This Matters

A magic value protects nothing once someone reads the source, a log, a browser history or a proxy capture, and it cannot be rotated without a release. A cookie named admin is the client deciding its own privileges.

What Gets Flagged

if request.args.get("debug") == "letmein":      # FLAGGED
    session["is_admin"] = True

if request.GET.get('role') == "admin":         # FLAGGED
    return render(request, "panel.html", {"username": "admin"})

if (req.query.backdoor === 'open-sesame') return next()   // FLAGGED

A cookie named for a privilege or login state compared on the line that reads it, or through a variable assigned from it, is a security decision on a cookie: VNX-784 reports it (if request.COOKIES.get('admin') == "1":), so VNX-656 does not report the line again.

Remediation

Remove the back door. Support and debug access should go through normal authentication with a privileged role.
Keep authorisation state on the server (session, token claims), never in a client-set cookie or header.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-656
// nosec vnx-656

Or record an ignore rule: vulnetix ignore add --rule vnx-656 --reason "...". See Suppressing findings.