logo

Database

Java Insecure Trust Manager Used

Description

Detects the use of insecure trust managers in SSL/TLS configurations that could bypass certificate validation. This vulnerability can allow man-in-the-middle attacks by accepting invalid or untrusted certificates, compromising secure communications.

Weakness:

350 - Insecure digital certificates - Chain of trust

Category: Access Subversion

Detection Strategy

    • Identifies calls to SSLContextBuilder.trustManager() method in Java code

    • Checks if the trust manager implementation accepts all certificates without proper validation

    • Reports a vulnerability when custom trust managers bypass normal certificate verification

    • Focuses on SSL/TLS configuration code where security settings are being customized

Vulnerable code example

import javax.net.ssl.*;

public class InsecureSSLExample {
    public SSLContext createInsecureSSL() throws Exception {
        // Vulnerable: Uses an insecure trust manager that accepts all certificates
        TrustManager[] trustAllCerts = new TrustManager[] {
            new X509TrustManager() {
                public void checkClientTrusted(X509Certificate[] certs, String authType) {}...

✅ Secure code example

import javax.net.ssl.*;
import java.security.KeyStore;

public class SecureSSLExample {
    public SSLContext createSecureSSL() throws Exception {
        // Use default trust store manager instead of accepting all certs
        TrustManagerFactory tmf = TrustManagerFactory.getInstance(
            TrustManagerFactory.getDefaultAlgorithm());...