Description

Detects the use of weak CBC (Cipher Block Chaining) cipher suites in Java Spring server configurations. CBC mode ciphers can be vulnerable to padding oracle attacks if not properly implemented, potentially compromising encrypted communications.

Detection Strategy

• Scans Java Spring security configuration files for server-side cipher suite specifications

• Identifies configuration blocks where server cipher suites are defined

• Reports a vulnerability when CBC mode ciphers are specified in the server configuration

• Only triggers on explicit server-side cipher suite configurations, not client-side or general crypto settings

Vulnerable code example

server:
  ssl:
    enabled-protocols: TLSv1.2
    key-store: keystore.p12
    key-store-password: secret123
    ciphers:
      # Vulnerable: Using weak CBC cipher suites that are susceptible to padding oracle attacks
      - TLS_ECDHE_RSA_WITH_AES_256_CBC_SHA...

✅ Secure code example

server:
  ssl:
    enabled-protocols: 
      - TLSv1.2  # Minimum TLS 1.2, removes support for older versions
      - TLSv1.3  # Prefer TLS 1.3 when available
    key-store: ${KEY_STORE_PATH}  # Use environment variable instead of hardcoded path
    key-store-password: ${KEY_STORE_PASSWORD}  # Externalize sensitive credentials
    ciphers:...