App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.

ID

objectivec.network.ios_self_signed_ssl

Severity

critical

Resource

Network

Language

Objective-C

Description

App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.

Rationale

App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.

The following code illustrates a vulnerable pattern detected by this rule:

@interface BadSSLDelegate : NSObject <NSURLSessionDelegate>
@end

@implementation BadSSLDelegate

- (BOOL)connection:(NSURLConnection *)connection canAuthenticateAgainstProtectionSpace:(NSURLProtectionSpace *)protectionSpace {
    // VULNERABLE: App allows self signed or invalid SSL certificates. App is vulnerable to MITM attacks.
    return YES;
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References