Skip to main content

Insecure encryption algorithm - SSL/TLS

Need​

Implementation of secure encryption algorithms and disabling insecure TLS protocol versions

Context​

  • Usage of PHP for server-side web development
  • Usage of Illuminate/Http for handling HTTP requests and responses in Laravel

Description​

Non compliant code​

<?php

use Illuminate\\Support\\Facades\\Http;

$response = Http::withOptions([
    'verify' => false,
])->get('https://insecure-server.com');

echo $response->body();

?>

The above code is an example of a PHP script in Laravel that sends an HTTP GET request to a server. The 'verify' option is set to 'false' which means that Laravel will not verify the SSL certificate of the server. This can lead to Man-in-the-middle (MITM) attacks as the client cannot verify the authenticity of the server. The client will accept any SSL certificate including those signed by untrusted sources.

The potential risk is that sensitive data can be intercepted by attackers, as the communication between the client and server is not secure. Therefore, it is crucial to always use secure connections and verify SSL certificates when communicating with servers.

Steps​

  • Identify the insecure TLS protocol versions that are being used.
  • Disable the insecure versions of the TLS protocol on the server.
  • Enable only secure versions of the TLS protocol on the server.
  • Update the server's configuration to only allow secure cipher suites.
  • In the PHP code, remove the 'verify' option set to false. This option disables SSL certificate verification, making the connection insecure.
  • Test the server to ensure that only secure versions of the TLS protocol are being used.

Compliant code​

<?php

use Illuminate\\Support\\Facades\\Http;

$response = Http::get('https://secure-server.com');

echo $response->body();

?>

The original code was vulnerable due to the use of insecure TLS protocol versions and the disabling of SSL certificate verification. This could potentially expose sensitive data to attackers.

The updated code removes the 'verify' option that was set to false. This option, when set to false, disables SSL certificate verification, making the connection insecure. By removing this option, the code now defaults to 'verify' => true, which means SSL certificate verification is enabled, making the connection secure.

In addition to updating the code, it's also necessary to update the server's configuration to only allow secure versions of the TLS protocol and secure cipher suites. This ensures that the server does not allow the usage of insecure TLS protocol versions.

After making these changes, it's important to test the server to ensure that only secure versions of the TLS protocol are being used. This can be done by using various tools that are available for testing the security of TLS configurations.

Remember, maintaining the security of your server and your code is an ongoing process that requires regular review and updates.

References​

Last updated on