Cleartext transmission of sensitive information

ID

scala.endpoint.scala_endpoint_rule_unencryptedsocket

Severity

low

Remediation Complexity

medium

Remediation Risk

medium

Remediation Effort

medium

Resource

Endpoint

Language

Scala

Description

Beyond using an SSL socket, you need to make sure your use of SSLSocketFactory does all the appropriate certificate validation checks to make sure you are not subject to man-in-the-middle attacks. Please read the OWASP Transport Layer Protection Cheat Sheet for details on how to do this correctly.

Rationale

Beyond using an SSL socket, you need to make sure your use of SSLSocketFactory does all the appropriate certificate validation checks to make sure you are not subject to man-in-the-middle attacks. Please read the OWASP Transport Layer Protection Cheat Sheet for details on how to do this correctly.

The following code illustrates a vulnerable pattern detected by this rule:

object MetricsClient {
  @throws[IOException]
  private[this] def listenWithTls(): Unit = {
    val listener = SSLServerSocketFactory.getDefault.createServerSocket(9443)
    listener.close
  }

  // A listening socket is not reported: what reaches it is the peer's choice, not ours.
  @throws[IOException]
  private[this] def listenInTheClear(): Unit = {
    val listener = new ServerSocket(9443)
    listener.close
  }

  @throws[IOException]
  private[this] def listenEveryOtherWay(): Unit = {
    val anyPort = new ServerSocket
    anyPort.close
    val withBacklog = new ServerSocket(9443, 10)
    withBacklog.close
    val loopback = Array(127.toByte, 0.toByte, 0.toByte, 1.toByte)
    val bound = new ServerSocket(9443, 10, InetAddress.getByAddress(loopback))
    bound.close
  }

  @throws[IOException]
  private[this] def connectWithTls(): Unit = {
    val connection = SSLSocketFactory.getDefault.createSocket("metrics.internal", 443)
    request(connection)
  }

  @throws[IOException]
  private[this] def connectInTheClear(): Unit = {
    // VULNERABLE: Cleartext transmission of sensitive information
    val connection = new Socket("metrics.internal", 80)
    request(connection)
  }

  @throws[IOException]
  private[this] def request(connection: Socket): Unit = {
    val out = new PrintWriter(connection.getOutputStream)
    out.write("GET /metrics HTTP/1.0\nHost: metrics.internal\n\n")
    out.flush
    val in = new BufferedReader(new InputStreamReader(connection.getInputStream))
    var line = in.readLine
    while (line != null) {
      println(line)
      line = in.readLine
    }
    connection.close
  }
}

Remediation

Follow secure coding practices and review the references below for detailed remediation guidance.

Configuration

This detector does not need any configuration.

References

© 2026 Xygeni. All rights reserved