Description

Detects insecure SMTP email connections in Java applications using Apache Commons Email where SSL certificate validation is disabled or missing. This vulnerability could allow attackers to intercept email communications through man-in-the-middle attacks, potentially exposing sensitive information.

Detection Strategy

• Check if the Apache Commons Email library (org.apache.commons.mail) is imported in the code

• Look for email send() method calls in the code

• Verify if the email object is created using SimpleEmail or similar unsafe email constructors

• Check if there are no proper SSL/TLS certificate validation checks for the email connection

• Report a vulnerability if an email is sent without proper certificate validation

Vulnerable code example

import org.apache.commons.mail.Email;
import org.apache.commons.mail.SimpleEmail;
import org.apache.commons.mail.DefaultAuthenticator;

public void sendInsecureEmail() {
    Email email = new SimpleEmail();
    email.setHostName("smtp.server.com");
    email.setSmtpPort(465);...

✅ Secure code example

import org.apache.commons.mail.Email;
import org.apache.commons.mail.SimpleEmail;
import org.apache.commons.mail.DefaultAuthenticator;

public void sendSecureEmail() {
    Email email = new SimpleEmail();
    email.setHostName("smtp.server.com");
    email.setSmtpPort(465);...