Description

Detects usage of Ruby's Net::Telnet or Net::SSH::Telnet classes which transmit credentials and data in plaintext. Telnet protocol does not encrypt network traffic, potentially exposing sensitive information to network eavesdropping attacks.

Detection Strategy

• Check if the code imports 'net/telnet' library

• Look for instantiation of Net::Telnet or Net::SSH::Telnet objects using the new() method

• Report a vulnerability when Telnet objects are created as they indicate use of insecure plaintext communication

Vulnerable code example

require 'net/telnet'

# Establishes an insecure Telnet connection without encryption
host = Net::Telnet::new("Host" => "localhost",  # Vulnerable: Uses unencrypted Telnet protocol
                        "Timeout" => 10,
                        "Prompt" => /[$%#>] \z/n)

host.login("admin", "password")  ...

✅ Secure code example

require 'net/ssh'

# Using SSH instead of Telnet for encrypted communication
ssh = Net::SSH.start('localhost', 'admin',
                    password: 'password',
                    timeout: 10)

# Execute command over encrypted SSH channel...