VNX-767: Access to Critical Private Variable via Public Method

Field	Value
Rule ID	VNX-767
Severity	Low
SARIF level	note
Kind	sast
Languages	Java
CWE	CWE-767
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	critical-access-decl-non-final cwe-767
Source	internal/sast/rules/vnx-767.rego

Overview

VNX-767 maps to CWE-767: Access to Critical Private Variable via Public Method. It reports a public, no-argument Java method whose body returns, unchanged, a private field of the same file that holds key or secret material:

• a field typed PrivateKey, SecretKey, KeyPair, KeyStore or SecretKeySpec;
• a char[] or byte[] whose name says it is a password, secret, key, PIN, seed or passphrase (the caller receives the live buffer);
• a String named for a secret, an API key, a private, signing, encryption or master key, or a passphrase.

Not reported: getters that return a copy (clone(), Arrays.copyOf), methods annotated @Override (framework contracts such as UserDetails.getPassword()), private and package-private methods, String password and token fields (entity and DTO accessors, usually holding a hash or a value the caller is meant to have), returns of local variables, comments and test sources. Setters are not judged.

Why This Matters

Declaring the field private achieves nothing once a public method hands it out. A returned char[] or byte[] is the object’s own buffer: the caller can read it, keep it after the owner wipes its copy, or overwrite it. A returned PrivateKey lets any code sign as the application.

What Gets Flagged

private char[] password;
public char[] getPassword() { return password; }   // flagged

private PrivateKey privateKey;
public PrivateKey getPrivateKey() {                  // flagged
    return this.privateKey;
}

Not flagged:

public char[] getPassword() { return password.clone(); }

@Override
public String getPassword() { return password; }    // UserDetails contract

Remediation

1. Keep the secret inside the class and expose an operation that uses it (sign(data), authenticate(conn)) instead of the secret itself.
2. When the value must leave the class, return a copy and document that the caller must clear it.

References

• CWE-767: Access to Critical Private Variable via Public Method
• SEI CERT OBJ05-J: Do not return references to private mutable class members

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-767
// nosec vnx-767

Or record an ignore rule: vulnetix ignore add --rule vnx-767 --reason "...". See Suppressing findings.