Skip to main content

Use of an insecure channel - useSslProtocol()

Need​

Secure communication channel for the application

Context​

  • Usage of PHP 7.0+ for server-side scripting and web development
  • Usage of Illuminate/Http for HTTP request handling in Laravel

Description​

Non compliant code​

<?php

use Illuminate\\Support\\Facades\\Http;

$response = Http::withOptions([
    'verify' => false,
])->get('https://example.com');

?>

In the above code, we are using Laravel's HTTP client to make a GET request to 'https://example.com'. The 'verify' option is set to 'false', which means SSL certificate verification is disabled.

This is the equivalent of using the useSslProtocol() function, as it allows the trust manager to trust all server certificates presented to it. While this may be convenient for local development, it poses a serious security risk in a production environment.

By setting 'verify' to 'false', we are effectively saying "trust all SSL certificates, regardless of who they are issued by". This opens the door to potential man-in-the-middle (MITM) attacks, where an attacker can intercept the communication between the client and the server, potentially gaining access to sensitive information.

In a MITM attack, the attacker could present their own SSL certificate and because we've set 'verify' to 'false', our application would trust it and establish a secure connection with the attacker instead of the intended server. The attacker can then eavesdrop on the communication, manipulate the data, or even impersonate the server to gain access to sensitive information.

Therefore, it is highly recommended to enable SSL certificate verification in a production environment to ensure the security of your application.

Steps​

  • Remove the 'verify' option set to false in the HTTP request. This option disables SSL certificate verification, making your application vulnerable to man-in-the-middle attacks.
  • Ensure that SSL certificate verification is enabled. By default, this should be the case if the 'verify' option is not specified.
  • If you need to disable SSL verification for local development, make sure to use environment-specific configuration. In production, SSL verification should always be enabled.
  • Consider using a package that provides a trust manager with more granular control over certificate validation if you need more flexibility.

Compliant code​

<?php

use Illuminate\\Support\\Facades\\Http;

$response = Http::get('https://example.com');

?>

The previous code was vulnerable due to the use of an insecure channel for HTTP requests. The 'verify' option was set to false, which disabled SSL certificate verification. This made the application susceptible to man-in-the-middle attacks.

The updated code removes the 'verify' option, enabling SSL certificate verification by default. This ensures that the application only communicates with servers that have a valid SSL certificate, providing protection against man-in-the-middle attacks.

If you need to disable SSL verification for local development, consider using environment-specific configuration. This allows you to disable SSL verification in your local development environment while ensuring it remains enabled in production.

For more complex needs, consider using a package that provides a trust manager with more granular control over certificate validation. This can provide additional flexibility and security for your application.

References​

Last updated on