logo

Database

Properties Smtp Port 25 Unencrypted

Description

Identifies insecure SMTP server configurations in Java properties files that use unencrypted port 25 without STARTTLS protection. This creates a risk of email communications being intercepted since messages are transmitted in plaintext without encryption.

Weakness:

149 - Use of an insecure channel - SMTP

Category: Information Collection

Detection Strategy

    • Check for any property ending with 'mail.smtp.port' that is set to '25'

    • Verify that no property ending with 'mail.smtp.starttls.enable' is set to 'true'

    • Report a vulnerability when port 25 is used without STARTTLS encryption enabled

Vulnerable code example

# application.properties
spring.mail.host=smtp.example.com
spring.mail.username=user
spring.mail.password=pass
spring.mail.properties.mail.smtp.port=25  # Vulnerable: Using insecure default SMTP port 25 instead of TLS port
spring.mail.properties.mail.smtp.auth=true

✅ Secure code example

# application.properties
spring.mail.host=smtp.example.com
spring.mail.username=user
spring.mail.password=pass
spring.mail.properties.mail.smtp.port=587  # Using secure TLS port instead of insecure port 25
spring.mail.properties.mail.smtp.auth=true
spring.mail.properties.mail.smtp.starttls.enable=true  # Enable TLS encryption for secure email transmission
spring.mail.properties.mail.smtp.starttls.required=true  # Require TLS to prevent fallback to insecure connection