Description

Detects attempts to bypass SSL hostname verification in Scala applications. This vulnerability occurs when applications disable or weaken the verification of SSL certificate hostnames, which could allow attackers to perform man-in-the-middle attacks using invalid certificates.

Detection Strategy

• Check if code imports SSL-related libraries/packages

• Look for method calls that set default hostname verifiers with weak/no validation

• Detect creation of SSL socket factories or hostname verifiers that skip proper certificate validation

• Report vulnerabilities when hostname verification is disabled or uses permissive validation logic

Vulnerable code example

import javax.net.ssl._
import org.apache.http.conn.ssl.NoopHostnameVerifier

class SSLBypass {
  def createInsecureConnection() {
    // Vulnerable: Disables hostname verification completely
    val insecureVerifier = new HostnameVerifier {
      override def verify(hostname: String, session: SSLSession): Boolean = true...

✅ Secure code example

import javax.net.ssl._
import java.net.URL

class SSLSecure {
  def createSecureConnection() {
    // Secure: Verify hostnames against allowlist of trusted domains
    val allowedHosts = Set("api.example.com", "auth.example.com") 
    val secureVerifier = new HostnameVerifier {...