Description

Detects the usage of weak or outdated SSL/TLS protocol versions in application code. Using deprecated SSL/TLS versions (like SSL 3.0, TLS 1.0, or TLS 1.1) exposes applications to known vulnerabilities and can lead to man-in-the-middle attacks, data breaches, and compromised secure communications.

Detection Strategy

• Identifies direct references to specific SSL/TLS protocol versions in configuration or code

• Looks for SSL/TLS configuration settings that enable or allow legacy protocol versions

• Checks for explicit protocol version specifications in SSL/TLS client or server setup code

• Detects hardcoded protocol version constants that reference outdated SSL/TLS versions

Vulnerable code example

const https = require('https');
const tls = require('tls');
const constants = require('node:crypto');

// Vulnerable: Uses deprecated TLS 1.0 protocol
const unsafeOptions = {
  secureProtocol: 'TLSv1_method'  // Noncompliant: TLS 1.0 is insecure
};...

✅ Secure code example

const https = require('https');
const tls = require('tls');
const constants = require('node:crypto');

// Secure: Uses modern TLS configuration
const safeOptions = {
  minVersion: 'TLSv1.2',  // Minimum TLS 1.2 for legacy compatibility
  maxVersion: 'TLSv1.3'   // Enable latest TLS 1.3 for maximum security...