Description

This vulnerability detector identifies insecure WebSocket connections in Rust applications using the tokio-tungstenite library. When WebSocket connections are made over unencrypted channels (ws:// instead of wss://), sensitive data transmitted between client and server can be intercepted by attackers through man-in-the-middle attacks.

Detection Strategy

• The detector only analyzes Rust code files that import the tokio-tungstenite WebSocket library

• It examines function calls to WebSocket connection methods (like connect, connect_async, or similar connection establishment functions)

• For each connection call, it checks if the WebSocket URL uses an insecure protocol (ws://) instead of the secure protocol (wss://)

• A vulnerability is reported when a WebSocket connection is established using an unencrypted ws:// URL, making the connection susceptible to eavesdropping and tampering

Vulnerable code example

use tokio_tungstenite::{connect_async, connect_async_tls_with_config, Connector};

async fn vulnerable_websocket() -> Result<(), Box<dyn std::error::Error>> {
    // Vulnerable: plaintext ws:// scheme exposes data
    let (_stream, _resp) = connect_async("ws://echo.websocket.org").await?;
    
    let url = "ws://127.0.0.1:9000";
    // Vulnerable: plaintext connection via variable...

✅ Secure code example

use std::sync::Arc;
use tokio_tungstenite::{connect_async, connect_async_tls_with_config, connect_async_with_config, Connector};

fn rustls_client_config() -> Arc<rustls::ClientConfig> {
    unimplemented!()
}

async fn secure_websocket() -> Result<(), Box<dyn std::error::Error>> {...