Use of Insecure SMTP Channel - Elixir

Need

Ensure confidentiality and integrity of data during transmission

Context

1. Usage of Elixir (v1.10+) for building scalable and fault-tolerant applications
2. Usage of Swoosh library for email sending

Description

Insecure Code Example

def send_email(email) do
  {:ok, pid} = Swoosh.Adapters.SMTP.start_link(port: 25, tls: :none)
  email |> MyApp.Mailer.deliver(pid)
end

The code above is vulnerable because it sends an email using the Swoosh SMTP adapter without encryption (tls: :none). This means that all data sent in the email can be easily intercepted and read by any party that can listen on the network.

Steps

1. Enable SSL/TLS in the SMTP settings.
2. Ensure the use of valid and trusted certificates.
3. Perform periodic reviews and updates of security configurations.

Secure Code Example

def send_email(email) do
  {:ok, pid} = Swoosh.Adapters.SMTP.start_link(port: 465, tls: :always, ssl_opts: [{:versions, [:'tlsv1.2']}])
  email |> MyApp.Mailer.deliver(pid)
end

The secure code uses the SMTPS protocol which operates on port 465 and uses SSL/TLS to encrypt the communication channel. The 'ssl_opts' option is set to use TLS version 1.2 which is currently considered secure.

References

Last updated

2023/09/18