Description

Identifies the use of insecure or deprecated SSL/TLS cipher configurations in Java applications. Using weak cipher suites can make SSL/TLS connections vulnerable to attacks, potentially compromising data confidentiality and integrity during transmission.

Detection Strategy

• Identifies calls to SSLContext.getInstance() method in Java code (including variations with different package qualifiers like javax.net.ssl, net.ssl, etc.)

• Examines the cipher suite parameter passed to getInstance() method

• Reports a vulnerability if the specified cipher suite is considered weak or insecure (e.g., 'SSL', 'SSLv3', 'TLS', 'TLSv1')

• Alerts when deprecated or weak encryption protocols are used instead of recommended secure versions like TLS 1.2 or higher

Vulnerable code example

import javax.net.ssl.SSLContext;

public class InsecureSSL {
    private static final String PROTOCOL = "SSLv3";  // Vulnerable: Using deprecated SSLv3 protocol
    
    public void createInsecureContext() throws Exception {
        SSLContext context = SSLContext.getInstance(PROTOCOL);  // Creates context with known-vulnerable SSL version
    }...

✅ Secure code example

import javax.net.ssl.SSLContext;

public class SecureSSL {
    private static final String PROTOCOL = "TLSv1.3";  // Use latest TLS protocol version
    
    public void createSecureContext() throws Exception {
        SSLContext context = SSLContext.getInstance(PROTOCOL);  // Creates context with secure TLS version
    }...