VNX-912: Hidden functionality: master password or hidden account in a credential check

Reports a credential check that also accepts a hard-coded master password or token beside the real verification, or a built-in username and password pair compared to literals.

Field	Value
Rule ID	`VNX-912`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	Go, Java, JavaScript / TypeScript, PHP, Python, Ruby
CWE	CWE-912
CAPEC	CAPEC-97
ATT&CK	T1557
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`backdoor` `hidden-functionality` `master-password` `cwe-912`
Source	`internal/sast/rules/vnx-912.rego`

Overview

A credential check with a hidden way in: the real verification (check_password, password_verify, a bcrypt or argon compare, authenticate, matches, verify, checkpw) is OR-ed on the same condition line with a comparison of the supplied password, PIN, token, secret or API key against a hard-coded literal, so a master password logs in as anyone. The rule also reports a username and a password both compared to literals in one AND-ed condition: a hidden built-in account.

Why This Matters

Anyone who reads the source, a leaked copy or the compiled binary learns a credential that works for every account, and it never appears in the user store, so audits of accounts do not find it.

What Gets Flagged

if check_password_hash(user.pw_hash, password) or password == "Spring2019!":
    login_user(user)

if username == "support" and password == "s3rv1ce-desk":
    return grant_admin()

if (encoder.matches(password, user.getHash()) || password.equals("Adm1nOverride")) {

if (await bcrypt.compare(req.body.password, user.hash) || req.body.password === 'qa-override') {

Not flagged: comparisons with empty or two-character literals, != tests, password-policy checks that are not OR-ed with a verifier, field-type comparisons (type === 'password'), test files, comments and strings. A hidden request parameter that grants access is VNX-656; hard-coded credentials in general are VNX-798.

Remediation

Remove the literal comparison. Support and recovery access belongs in real, audited accounts with their own credentials, or in a break-glass procedure that is logged and rotated.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-912
// nosec vnx-912

Or record an ignore rule: vulnetix ignore add --rule vnx-912 --reason "...". See Suppressing findings.