Description

Detects insecure SMTP configurations in Java Spring applications that use port 25 without enforcing STARTTLS encryption. This creates a security risk where email communications could be transmitted in plaintext, potentially exposing sensitive information to network eavesdropping.

Detection Strategy

• Check if there are Spring configuration files that contain SMTP settings

• Verify if the configuration specifies 'smtp' as the protocol

• Confirm if port 25 is explicitly set in the configuration

• Validate that the configuration path matches the expected mail properties structure

• Report a vulnerability if SMTP is configured to use port 25 without STARTTLS protection

Vulnerable code example

spring:
  mail:
    host: smtp.example.com
    port: 25
    username: mailUser
    password: mailPass
    properties:
      mail:...

✅ Secure code example

spring:
  mail:
    host: smtp.example.com
    port: 587  # Changed to 587 - standard TLS port for SMTP
    username: mailUser
    password: mailPass
    properties:
      mail:...