VNX-732: Incorrect permission assignment for a critical resource (Python)

Reports Python chmod calls (including the chmod command run through os.system or subprocess) that make a file world-writable, os.umask() values that leave others-write unmasked, and chmod of key or credential files to a mode that others can read.

Field	Value
Rule ID	`VNX-732`
Severity	High
SARIF level	`error`
Kind	`sast`
Languages	Python
CWE	CWE-732
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:H/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:H/DI:H/EX:H/EC:N/P:H`
Tags	`insecure-permissions` `chmod` `umask` `cwe-732`
Source	`internal/sast/rules/vnx-732.rego`

Overview

VNX-732 maps to CWE-732: Incorrect Permission Assignment for Critical Resource. It reports three things in Python:

os.chmod/os.lchmod/os.fchmod or .chmod() with a world-writable mode. That is an octal literal ending in 2, 3, 6 or 7, or stat.S_IWOTH/stat.S_IRWXO, given directly, as mode=, or through a variable assigned up to ten lines above.
os.umask() with a value that leaves others-write unmasked, such as os.umask(0).
chmod of a path whose name says it holds a key or credential, to a mode that others can read.

What Gets Flagged

os.chmod(upload_dir, 0o777)                   # FLAGGED
Path("/var/lib/app/cache").chmod(0o777)       # FLAGGED
os.umask(0)                                   # FLAGGED
os.chmod(key_path, 0o644)                     # FLAGGED: key readable by everyone

Not reported:

owner-only and group modes (0o600, 0o640, 0o755 on ordinary files), and the sticky shared-directory mode 0o1777
umask values that mask others-write (0o022, 0o077)
the read-the-umask idiom old = os.umask(0); os.umask(old)
modes passed to os.open/os.makedirs, which the umask filters
test code, comments and strings

VNX-276 reports world-writable chmod across many languages.

Remediation

Use 0o600 for secrets, 0o700 for private directories, and 0o644/0o755 for files that must be readable.
Never clear the umask. Keep at least 0o022.

References

CWE-732: Incorrect Permission Assignment for Critical Resource

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-732
// nosec vnx-732

Or record an ignore rule: vulnetix ignore add --rule vnx-732 --reason "...". See Suppressing findings.