Description

Detects insecure implementations of TrustManager classes that accept all SSL/TLS certificates without proper verification. This vulnerability bypasses certificate validation, allowing attackers to perform man-in-the-middle attacks by using invalid or malicious certificates.

Detection Strategy

• Look for classes that implement TrustManager interfaces

• Check if these classes override certificate verification methods

• Flag implementations where trust verification methods are overridden to accept all certificates

• Specifically examine methods related to server certificate verification and issuer verification

• Report a vulnerability if the implementation does not perform proper certificate validation checks

Vulnerable code example

import javax.net.ssl.X509TrustManager;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateException;

public class InsecureTrustManager implements X509TrustManager {
    
    @Override
    public void checkClientTrusted(X509Certificate[] chain, String authType) throws CertificateException {...

✅ Secure code example

import javax.net.ssl.TrustManagerFactory;
import javax.net.ssl.X509TrustManager;
import java.security.KeyStore;
import java.security.cert.X509Certificate;
import java.security.cert.CertificateException;

public class SecureTrustManager implements X509TrustManager {
    private final X509TrustManager defaultTrustManager;...