VNX-671: Application overrides an operator-controlled security switch in the environment

Field	Value
Rule ID	VNX-671
Severity	Low
SARIF level	note
Kind	sast
Languages	JavaScript / TypeScript, Python
CWE	CWE-671
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	lack-of-administrator-control-over-security cwe-671 configuration
Source	internal/sast/rules/vnx-671.rego

Overview

VNX-671 maps to CWE-671: Lack of Administrator Control over Security. Some process-wide security switches are environment variables precisely so that whoever deploys the software decides them. Code that writes an insecure value into its own environment takes that decision away: the operator cannot turn the protection back on without changing the code.

Reported, when written unconditionally (os.environ[...] =, environ[...] =, os.putenv, os.environ.update({...}), os.environ.update(NAME=...), process.env.NAME =, process.env['NAME'] =):

Variable	Insecure value	Effect
OAUTHLIB_INSECURE_TRANSPORT, AUTHLIB_INSECURE_TRANSPORT	any true value	OAuth tokens over plain HTTP
GIT_SSL_NO_VERIFY	any true value	git skips TLS verification
PYTHONHTTPSVERIFY, NODE_TLS_REJECT_UNAUTHORIZED	0	certificate verification off
CURL_CA_BUNDLE, REQUESTS_CA_BUNDLE	""	requests skips verification

What Gets Flagged

os.environ["OAUTHLIB_INSECURE_TRANSPORT"] = "1"   # FLAGGED
os.environ["CURL_CA_BUNDLE"] = ""                 # FLAGGED

process.env["GIT_SSL_NO_VERIFY"] = "true";        // FLAGGED

What Is Not Flagged

• A write inside an if/elif/else block or on a one-line if (a debug switch the operator controls).
• os.environ.setdefault(...): the operator’s value still wins.
• A non-literal value (os.getenv("ALLOW_HTTP", ""), config.insecure ? '0' : '1'): the operator still decides.
• Safe values (1 for the verify switches, a CA bundle path, 0 for the insecure-transport flags), reading or removing the variable.
• Test files, comments and string literals.

NODE_TLS_REJECT_UNAUTHORIZED is also reported by VNX-CRYPTO-005; shell and Dockerfile settings of these variables are VNX-SEC-016.

Remediation

Delete the assignment and let the deployment set the variable when (and only where) it is genuinely needed, for example in a local development .env file.

References

• CWE-671: Lack of Administrator Control over Security
• oauthlib: OAUTHLIB_INSECURE_TRANSPORT

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-671
// nosec vnx-671

Or record an ignore rule: vulnetix ignore add --rule vnx-671 --reason "...". See Suppressing findings.