Description

Detects when Ruby HTTP client libraries are configured to bypass SSL certificate verification. This vulnerability allows applications to connect to servers with invalid SSL certificates, enabling potential man-in-the-middle attacks where attackers can intercept and modify HTTPS traffic.

Detection Strategy

• Checks if any of the HTTP client libraries (HTTParty, Faraday, rest-client) are imported in the Ruby code

• Identifies HTTP client configuration calls that explicitly disable SSL certificate verification

• Reports a vulnerability when SSL verification is disabled through parameters like verify: false, verify_ssl: false, or ssl_verify: false

• Monitors both direct configuration calls and middleware/connection setup methods that affect SSL verification

Vulnerable code example

require 'httparty'

# Disabling SSL verification allows MITM attacks
HTTParty.get("https://example.com", verify: false)

✅ Secure code example

require 'httparty'

# SSL verification enabled by default for secure HTTPS connections
HTTParty.get("https://example.com") 

# If custom SSL options needed, explicitly enable verification
# HTTParty.get("https://example.com", verify: true)