Description

This detector identifies if a server that supports TLS 1.3 can be downgraded to use less secure TLS protocol versions. A successful downgrade means an attacker could force the use of older, potentially vulnerable TLS versions even when TLS 1.3 is available, weakening the connection's security.

Detection Strategy

• Confirms the server supports TLS 1.3

• Attempts connections with older TLS protocol versions (excluding TLS 1.2)

• Reports a vulnerability if the server accepts connections using any protocol version older than TLS 1.2 when TLS 1.3 is available