...

It is also important to use SSL for secure Remote Method Invocation (RMI) communications because RMI depends on object serialization and serialized data must be safeguarded in transit. Gong et al. \[[Gong 2003|AA. Bibliography#Gong 03]\] describe how to secure RMI communications using {{SSLSockets}}.

Noncompliant Code Example

This example shows the use of regular sockets for a server application that does not protect sensitive information in transit. The insecure code for the corresponding client application follows the server's code.

  
// Exception handling has been omitted for the sake of brevity
class EchoServer { 
  public static void main(String[] args) throws IOException { 
    ServerSocket serverSocket = new ServerSocket(10007); 
    Socket socket = serverSocket.accept();
			
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true); 
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream())); 

    String inputLine; 
    while ((inputLine = in.readLine()) != null) { 
      System.out.println(inputLine); 
      out.println(inputLine); 
    }
      
    // close out, in, socket (preferably in a try-finally block)   
  }
}

class EchoClient {
  public static void main(String[] args) throws IOException { 
    Socket socket = new Socket("localhost", 9999);
						
    PrintWriter out = new PrintWriter(socket.getOutputStream(), true);
    BufferedReader in = new BufferedReader(
      new InputStreamReader(socket.getInputStream()));

    BufferedReader stdIn = new BufferedReader(
      new InputStreamReader(System.in));
			
    String userInput;
    while ((userInput = stdIn.readLine()) != null) {
      out.println(userInput);
      System.out.println(in.readLine());
    } 

    // close out, in, stdIn, socket (preferably in a try-finally block)   
  }
}

Compliant solution

This compliant solution makes use of SSLSockets to protect packets using the SSL/TLS security protocols.

...

Note that a program that makes use of SSLSockets will block indefinitely if it tries to connect to a port that is not using SSL. Similarly, a program that does not use SSLSockets will block when trying to establish a connection through a port that uses SSL.

Exceptions

SEC15-EX1: Because of the mechanisms that SSLSockets provide to ensure the secure transfer of packets, significant performance overhead may result. If no sensitive information is being transmitted, or the channel is not prone to attacks, regular Sockets are sufficient.

Risk assesment

Using plain sockets instead of SSLSockets means that the data's confidentiality and integrity is not guaranteed.

Automated Detection

The general case of automated detection appears to be infeasible, as determining which specific data may be passed through the socket is not statically computable. An approach that introduces a custom API for passing sensitive data via secure sockets may be feasible. User tagging of sensitive data would be a necessary requirement for such an approach.

Related Vulnerabilities

Search for vulnerabilities resulting from the violation of this guideline on the CERT website.

Bibliography

\[[API 2006|AA. Bibliography#API 06]\] 
\[[Gong 2003|AA. Bibliography#Gong 03]\] 11.3.3 "Securing RMI Communications"
\[[MITRE 2009|AA. Bibliography#MITRE 09]\] [CWE ID 311|http://cwe.mitre.org/data/definitions/311.html] "Failure to Encrypt Sensitive Data"
\[[Ware 2008|AA. Bibliography#Ware 08]\]

...