Description

Detects when SSL hostname verification is disabled in Python code by setting check_hostname to False in SSL contexts. This creates a security vulnerability by skipping certificate hostname validation, making the application susceptible to Man-in-the-Middle attacks.

Detection Strategy

• Identifies assignments to check_hostname property in SSL context configurations

• Verifies the assignment is made within an SSL context object

• Confirms the assignment disables the hostname verification (typically set to False)

• Reports a vulnerability when hostname verification is explicitly disabled through these settings

Vulnerable code example

import ssl

# Disabling hostname verification makes connections vulnerable to MITM attacks
ctx = ssl._create_unverified_context()
ctx.check_hostname = False  # Vulnerable: Explicitly disabling hostname checks

other_ctx = ssl.create_default_context()
other_ctx.check_hostname = False  # Vulnerable: Disabling hostname verification

✅ Secure code example

import ssl

# Create context with default secure settings including hostname verification
ctx = ssl.create_default_context()
# Default context already has check_hostname=True and verify_mode=CERT_REQUIRED

# If needed, create another context also using secure defaults
other_ctx = ssl.create_default_context()...