Description

Detects the configuration of weak or obsolete security protocols (SSL3, TLS 1.0, TLS 1.1) in C# applications using ServicePointManager.SecurityProtocol. Using deprecated protocols can expose applications to known cryptographic vulnerabilities and man-in-the-middle attacks.

Detection Strategy

• Look for assignments or references to SecurityProtocolType in the code

• Check if any of the following weak protocols are specified: SSL3, TLS 1.0, TLS 1.1, or None

• Report a vulnerability when explicit use of these deprecated protocols is found in SecurityProtocolType configurations

Vulnerable code example

using System.Net;

public class InsecureService {
    public InsecureService() {
        // Vulnerable: Using only TLS 1.0 which is deprecated and insecure
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls;
    }
}

✅ Secure code example

using System.Net;

public class SecureService {
    public SecureService() {
        // Secure: Using TLS 1.2 and 1.3 for strong encryption and security
        ServicePointManager.SecurityProtocol = SecurityProtocolType.Tls12 | SecurityProtocolType.Tls13;
    }
}