Insecure Transport

ID

go.insecure_transport

Severity

high

Resource

Information Leak

Language

Go

Tags

CWE:319, NIST.SP.800-53, OWASP:2021:A4, PCI-DSS:6.5.4, PCI-DSS:6.5.6

Description

Insecure transport refers to vulnerabilities that arise when data is transmitted over a network without adequate encryption, making it vulnerable to interception and tampering by attackers.

This often involves using protocols like HTTP instead of HTTPS, or neglecting to configure SSL/TLS properly.

Rationale

Insecure transport vulnerabilities occur when sensitive data like credentials, personal information, or other sensitive communications are transmitted in plaintext or via improperly configured encryption protocols. Attackers can exploit such vulnerabilities through techniques like packet sniffing or man-in-the-middle attacks, compromising data integrity and confidentiality.

Exchange of sensitive data should always occur over secure channels to ensure that unauthorized parties cannot access or alter it.

Consider this simple example:

package insecure_transport

import (
	"net/http"
)

func main() {
	client := &http.Client{}

	req, err := http.NewRequest("GET", "http://example.com", nil) // FLAW
}

In this example, data is transmitted using HTTP instead of the secured HTTPS protocol, making it susceptible to interception.

Remediation

To address insecure transport vulnerabilities, consider the following secure coding practices:

1. Use HTTPS: Always use HTTPS for data transmission. Configure your software to use HTTPS rather than HTTP. This involves obtaining a valid SSL/TLS certificate and configuring the target server(s) to support HTTPS.

2. Configure TLS Properly: Ensure proper configuration of TLS/SSL, avoiding outdated or vulnerable versions. Use strong ciphers and the latest protocol versions (TLS 1.2 or above).

3. Verify Certificates: When establishing HTTPS connections in software, ensure certificate validation is enabled and properly handled to avoid man-in-the-middle attacks.

4. Use Security Libraries: Use well-established libraries for making secure HTTP requests. Such libraries often come with sensible defaults for HTTP over TLS transport.

Configuration

The detector has the following configurable parameters:

  • allowedDomains, that indicates the domains that are allowed, even when using an insecure protocol.

References