Description

Detects when gRPC servers in Go applications are configured without secure credentials, allowing unencrypted communication. This creates a security risk as sensitive data transmitted between client and server could be intercepted or modified by attackers.

Detection Strategy

• Confirms the presence of gRPC package imports in the Go source code

• Identifies gRPC server configurations and initialization points

• Checks if the server is configured without secure credentials or using insecure connection options

• Reports a vulnerability when a gRPC server is set up without proper security credentials

Vulnerable code example

package main

import (
    "google.golang.org/grpc"
    "net"
)

func main() {...

✅ Secure code example

package main

import (
    "google.golang.org/grpc"
    "google.golang.org/grpc/credentials"
    "net"
    "log"
)...