Movatterモバイル変換

[0]ホーム
URL:

CodeQL documentation
CodeQL resources

Unsafe certificate trust

ID: java/unsafe-cert-trustKind: problemSecurity severity: 9.8Severity: warningPrecision: mediumTags:   - security   - external/cwe/cwe-273Query suites:   - java-security-extended.qls   - java-security-and-quality.qls

Click to see the query in the CodeQL repository

Java offers two mechanisms for SSL authentication - trust manager and hostname verifier (the later is checked by thejava/insecure-hostname-verifier query). The trust manager validates the peer’s certificate chain while hostname verification establishes that the hostname in the URL matches the hostname in the server’s identification.

WhenSSLSocket orSSLEngine are created without a securesetEndpointIdentificationAlgorithm, hostname verification is disabled by default.

This query checks whethersetEndpointIdentificationAlgorithm is missing, thereby making the application vulnerable to man-in-the-middle attacks. The query also covers insecure configurations ofcom.rabbitmq.client.ConnectionFactory.

Recommendation

Validate SSL certificates in SSL authentication.

Example

The following two examples show two ways of configuring SSLSocket/SSLEngine. In the ‘BAD’ case,setEndpointIdentificationAlgorithm is not called, thus no hostname verification takes place. In the ‘GOOD’ case,setEndpointIdentificationAlgorithm is called.

publicstaticvoidmain(String[]args){{SSLContextsslContext=SSLContext.getInstance("TLS");SSLEnginesslEngine=sslContext.createSSLEngine();SSLParameterssslParameters=sslEngine.getSSLParameters();sslParameters.setEndpointIdentificationAlgorithm("HTTPS");//GOOD: Set a valid endpointIdentificationAlgorithm for SSL engine to trigger hostname verificationsslEngine.setSSLParameters(sslParameters);}{SSLContextsslContext=SSLContext.getInstance("TLS");SSLEnginesslEngine=sslContext.createSSLEngine();//BAD: No endpointIdentificationAlgorithm set}{SSLContextsslContext=SSLContext.getInstance("TLS");finalSSLSocketFactorysocketFactory=sslContext.getSocketFactory();SSLSocketsocket=(SSLSocket)socketFactory.createSocket("www.example.com",443);SSLParameterssslParameters=sslEngine.getSSLParameters();sslParameters.setEndpointIdentificationAlgorithm("HTTPS");//GOOD: Set a valid endpointIdentificationAlgorithm for SSL socket to trigger hostname verificationsocket.setSSLParameters(sslParameters);}{com.rabbitmq.client.ConnectionFactoryconnectionFactory=newcom.rabbitmq.client.ConnectionFactory();connectionFactory.useSslProtocol();connectionFactory.enableHostnameVerification();//GOOD: Enable hostname verification for rabbitmq ConnectionFactory}{com.rabbitmq.client.ConnectionFactoryconnectionFactory=newcom.rabbitmq.client.ConnectionFactory();connectionFactory.useSslProtocol();//BAD: Hostname verification for rabbitmq ConnectionFactory is not enabled}}

References

[8]ページ先頭
©2009-2025 Movatter.jp