VNX-931: Authorization rule opens every request, an admin path or a state-changing endpoint to anyone

Field	Value
Rule ID	VNX-931
Severity	Low
SARIF level	note
Kind	sast
Languages	Java, Kotlin
CWE	CWE-931
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	CWSS:1.0/TI:L/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:L/DI:H/EX:L/EC:N/P:L
Tags	missing-auth-cc spring-security cwe-931
Source	internal/sast/rules/vnx-931.rego

Overview

CWE-931 is an OWASP Top Ten 2013 category with no code shape of its own; this rule reports the concrete missing-authorization configuration it was generated for, in Java and Kotlin: Spring Security anyRequest().permitAll() (also split across lines, and the Kotlin DSL authorize(anyRequest, permitAll)); a matcher (requestMatchers, antMatchers, mvcMatchers, regexMatchers, pathMatchers or the Kotlin authorize) for “/**”, an /admin, /management or /internal path, the whole /actuator tree or EndpointRequest.toAnyEndpoint() followed by permitAll(); and a JAX-RS/Jakarta @PermitAll on a method annotated @DELETE, @PUT or @PATCH. Not reported: permitAll on public paths (login, static assets, /actuator/health), formLogin()/logout() permitAll, @PermitAll on GET or POST methods (login and registration are public by design), StrictMode policies, comments and strings.

Why This Matters

permitAll() on every request, on the administrative tree or on the actuator endpoints turns off authentication for exactly the routes that most need it. A JAX-RS @PermitAll on a DELETE, PUT or PATCH method lets anyone change data.

What Gets Flagged

http.authorizeHttpRequests(auth -> auth
        .anyRequest().permitAll());
auth.requestMatchers("/admin/**").permitAll();
auth.requestMatchers(EndpointRequest.toAnyEndpoint()).permitAll();
authorize(anyRequest, permitAll)

@DELETE
@PermitAll
public void deleteUser(@PathParam("id") long id) { ... }

What Is Not Flagged

auth.requestMatchers("/login", "/css/**", "/actuator/health").permitAll()
    .requestMatchers("/admin/**").hasRole("ADMIN")
    .anyRequest().authenticated();
http.formLogin(form -> form.loginPage("/login").permitAll());

Remediation

1. End the chain with .anyRequest().authenticated() (or denyAll()).
2. Restrict administrative and actuator paths with hasRole(...); expose only /actuator/health publicly.
3. Use @RolesAllowed on state-changing JAX-RS methods.
4. For a confirmed false positive, add a vulnetix-ignore: VNX-931 comment on the line.

References

• CWE-931
• Spring Security: Authorize HTTP Requests

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-931
// nosec vnx-931

Or record an ignore rule: vulnetix ignore add --rule vnx-931 --reason "...". See Suppressing findings.