Description

Detects the use of insecure or deprecated SSL/TLS cipher configurations in Kotlin applications. Using weak or outdated SSL/TLS configurations can expose applications to cryptographic attacks, potentially compromising the confidentiality and integrity of network communications.

Detection Strategy

• Identifies calls to SSLContext.getInstance() methods across different package variations (javax.net.ssl, net.ssl, etc.)

• Reports a vulnerability when SSLContext.getInstance() is called with a parameter that specifies an insecure or deprecated SSL/TLS protocol version

• Checks method arguments to determine if weak protocols like SSL 3.0, TLS 1.0, or other deprecated configurations are being used

Vulnerable code example

import javax.crypto.Cipher
import java.security.spec.RSAKeyGenParameterSpec
import java.security.MessageDigest
import javax.net.ssl.SSLContext

fun insecureConfig() {
    // Vulnerable: Using weak cipher algorithms
    val cipher1 = Cipher.getInstance("DES")  // Using outdated DES encryption...

✅ Secure code example

import javax.crypto.Cipher
import java.security.spec.RSAKeyGenParameterSpec
import java.security.MessageDigest
import javax.net.ssl.SSLContext

fun secureConfig() {
    // Using strong AES cipher with GCM mode for authenticated encryption
    val cipher = Cipher.getInstance("AES/GCM/NoPadding")...