Description

Detects unsafe hostname verifier implementations in Java that accept any hostname without proper validation. This creates a security risk by bypassing SSL/TLS certificate hostname verification, potentially allowing man-in-the-middle attacks where attackers can intercept and manipulate secure communications.

Detection Strategy

• Identifies classes that implement hostname verification interfaces (e.g., HostnameVerifier)

• Checks if the verify() method implementation always returns true or lacks proper hostname validation logic

• Reports a vulnerability when a hostname verifier accepts all certificates without checking if the hostname matches the certificate

Vulnerable code example

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.SSLSession;

public class InsecureVerifier implements HostnameVerifier {
    public boolean verify(String hostname, SSLSession session) {  // Vulnerable: accepts any hostname without verification
        return true;  // Always returns true, bypassing hostname validation
    }
}

✅ Secure code example

import javax.net.ssl.HostnameVerifier;
import javax.net.ssl.HttpsURLConnection;
import javax.net.ssl.SSLSession;

public class SecureVerifier implements HostnameVerifier {
    private final HostnameVerifier defaultVerifier = HttpsURLConnection.getDefaultHostnameVerifier();
    
    public boolean verify(String hostname, SSLSession session) {...