VNX-933: Script loaded over plain HTTP

CWE-933 is the OWASP Top Ten 2013 Security Misconfiguration category with no code shape of its own; this rule reports the concrete misconfiguration it was generated for, a page that loads executable script over plain http://, which anyone on the network path can replace with their own code. Reported: a <script> tag whose src is an http:// URL in HTML and server-side template files (.html, .htm, .php, .jsp, .erb, .ejs, .cshtml, .aspx, .vue, .svelte, .jsx, .tsx, Jinja, Twig, Handlebars and similar), with any quoting or letter case and with the src attribute on a later line of the start tag; and in JavaScript/TypeScript, an element made by document.createElement("script") whose src is set to an http:// URL a few lines later (el.src = or el.setAttribute("src", ...)), and $.getScript/jQuery.getScript or a worker's importScripts called with an http:// URL. Not reported: https:// and protocol-relative or relative src values, loopback development servers (localhost, 127.0.0.1, 0.0.0.0, [::1]), http:// URLs on links, images or inside inline script code, HTML comments (single-line or multi-line), test files, and script URLs assembled at run time. A tag with an integrity attribute is still reported: on an HTTPS page the browser blocks the script as mixed content, and on an HTTP page the attacker can rewrite the tag itself.

Field	Value
Rule ID	`VNX-933`
Severity	Medium
SARIF level	`warning`
Kind	`sast`
Languages	HTML, JavaScript / TypeScript, PHP, Java, C#, Ruby
CWE	CWE-933
CAPEC	CAPEC-66
ATT&CK	T1190
CWSS vector	`CWSS:1.0/TI:M/AP:RU/AL:S/IC:N/FC:LT/RP:RU/RL:S/AV:L/AS:N/IN:A/SC:A/BI:M/DI:H/EX:M/EC:N/P:C`
Tags	`cross-origin-script-inclusion` `cwe-933`
Source	`internal/sast/rules/vnx-933.rego`

Overview

CWE-933 is the OWASP Top Ten 2013 Security Misconfiguration category with no code shape of its own; this rule reports the concrete misconfiguration it was generated for, a page that loads executable script over plain http://, which anyone on the network path can replace with their own code. Reported: a <script> tag whose src is an http:// URL in HTML and server-side template files (.html, .htm, .php, .jsp, .erb, .ejs, .cshtml, .aspx, .vue, .svelte, Jinja, Twig, Handlebars and similar), with any quoting or letter case and with the src attribute on a later line of the start tag; and in JavaScript/TypeScript, an element made by document.createElement(“script”) whose src is set to an http:// URL a few lines later (el.src = or el.setAttribute(“src”, …)). Not reported: https:// and protocol-relative or relative src values, loopback development servers (localhost, 127.0.0.1, 0.0.0.0, [::1]), http:// URLs on links, images or inside inline script code, HTML comments, test files, and script URLs assembled at run time. A tag with an integrity attribute is still reported: on an HTTPS page the browser blocks the script as mixed content, and on an HTTP page the attacker can rewrite the tag itself.

Why This Matters

A script fetched over plain HTTP can be replaced by anyone on the network path (public Wi-Fi, a compromised router, an ISP injecting content), and the replacement runs with the page’s full privileges: it can read cookies, keystrokes and form data.

What Gets Flagged

<script src="http://code.jquery.com/jquery-1.12.4.min.js"></script>
<script
    type="text/javascript"
    src="http://maps.example-cdn.com/api/js?v=3">
</script>

var s = document.createElement('script');
s.src = 'http://widgets.example-chat.com/embed.js';

What Is Not Flagged

<script src="https://code.jquery.com/jquery-3.7.1.min.js" integrity="sha384-..." crossorigin="anonymous"></script>
<script src="/assets/app.js"></script>
<script type="module" src="http://localhost:5173/@vite/client"></script>
<img src="http://images.example.com/logo.png">

Remediation

Load the script over https:// and add a Subresource Integrity integrity attribute.
Or host the script yourself and serve it from your own origin.
Set a Content-Security-Policy with upgrade-insecure-requests as a backstop.
For a confirmed false positive, add a vulnetix-ignore: VNX-933 comment on the line.

References

Suppressing this rule

Put a nosec comment on the line, or on line 1 to cover the whole file. Use the comment marker of the file’s language (#, //, -- or ;):

# nosec vnx-933
// nosec vnx-933

Or record an ignore rule: vulnetix ignore add --rule vnx-933 --reason "...". See Suppressing findings.