Description

Detects hardcoded passwords in JSch (Java Secure Channel) configurations where passwords are directly specified in code using setPassword() method. This represents a security risk since hardcoded credentials can be extracted from source code or compiled applications, potentially leading to unauthorized system access.

Detection Strategy

• Check if the com.jcraft.jsch library is imported in the Java file

• Look for calls to setPassword() method on JSch-related objects

• Verify if the password parameter passed to setPassword() is a hardcoded string literal

• Report a vulnerability if a JSch object uses setPassword() with a hardcoded string value

Vulnerable code example

import com.jcraft.jsch.JSch;
import com.jcraft.jsch.Session;

public class VulnerableExample {
    public void connectSftp() {
        String hardcodedPass = "secret123";
        JSch jsch = new JSch();
        Session session = jsch.getSession("admin", "example.com", 22);...

✅ Secure code example

import com.jcraft.jsch.JSch;
import com.jcraft.jsch.Session;

public class SecureExample {
    public void connectSftp() {
        String configPassword = System.getenv("SFTP_PASSWORD"); // Get password from environment variable
        
        JSch jsch = new JSch();...