VNX-766: Critical Data Element Declared Public

Field	Value
Rule ID	VNX-766
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-766
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	critical-data-elem-declared-public cwe-766
Source	internal/sast/rules/vnx-766.rego

Overview

VNX-766 maps to CWE-766: Critical Data Element Declared Public. It reports a Java class field that is declared public and holds secret material:

• a non-final public field of type String, char[], byte[], CharSequence, a Map/Properties or a *Credentials type whose name says it is a password, secret, API key, private/signing/encryption/master key, token or credential;
• any public field typed PrivateKey, SecretKey, KeyPair, KeyStore or SecretKeySpec;
• a public final char[] or byte[] secret: final freezes the reference, not the contents.

Not reported: private, protected and package-private fields, public static final String constants (these are nearly always parameter or header names such as PASSWORD_PARAM), non-secret types (boolean passwordExpired, int tokenCount), names that describe metadata about a secret (passwordHint, tokenUrl, tokenType), local variables, comments, string literals and test sources.

Why This Matters

A public field has no access control at all: any class in the process, including a plugin, a deserialisation gadget or a logging helper that reflects over objects, can read the secret or overwrite it. A public mutable buffer also cannot be wiped reliably, because the owning class does not know who else holds it.

What Gets Flagged

public class MailSettings {
    public String password;                                   // flagged
    public static String apiKey = System.getenv("MAIL_API_KEY"); // flagged
    public PrivateKey signingKey;                             // flagged
    public static final char[] MASTER_PASSWORD = {'c', 'h'};  // flagged: contents are mutable
}

Not flagged:

public static final String PASSWORD_PARAM = "password";
private String password;
public boolean passwordExpired;

Remediation

1. Make the field private and expose only what callers need: a method that uses the secret, or an accessor that returns a copy.
2. Keep keys in a KeyStore or secret manager and pass them to the code that uses them rather than publishing them on a settings object.
3. Hold passwords in char[] owned by one class and clear them with Arrays.fill after use.

References

• CWE-766: Critical Data Element Declared Public
• SEI CERT OBJ01-J: Limit accessibility of fields

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-766
// nosec vnx-766

Or record an ignore rule: vulnetix ignore add --rule vnx-766 --reason "...". See Suppressing findings.