Description

Detects the usage of weak or insecure cipher suites in IBM MQ (WebSphere MQ) Java applications through JmqiUtils.toCipherSuite method. Using weak cipher suites can expose communications to cryptographic attacks, potentially compromising the confidentiality and integrity of messages.

Detection Strategy

• Identifies calls to com.ibm.mq.jmqi.JmqiUtils.toCipherSuite method in Java code

• Examines the cipher suite parameter passed to the toCipherSuite method

• Reports a vulnerability if the specified cipher suite uses weak or deprecated cryptographic algorithms

• Flags the issue when insecure cipher configurations are found in the method arguments

Vulnerable code example

import com.ibm.mq.jmqi.JmqiUtils;

class MQConnection {
    // Vulnerable: Using weak cipher suite that supports RSA key exchange
    private static final String CIPHER = "TLS_RSA_WITH_AES_128_CBC_SHA256";
    
    public void connect() {
        JmqiUtils.toCipherSuite(CIPHER);  // Security risk: Uses deprecated RSA key exchange...

✅ Secure code example

import com.ibm.mq.jmqi.JmqiUtils;

class MQConnection {
    // Secure: Using strong cipher suite with ECDHE for perfect forward secrecy
    private static final String CIPHER = "TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384";
    
    public void connect() {
        JmqiUtils.toCipherSuite(CIPHER);  // Safe: Modern cipher suite with forward secrecy...