Skip to main content

Insecure encryption algorithm - SSLContext

Need​

Secure encryption algorithm for SSLContext

Context​

  • Usage of Ruby for building dynamic and object-oriented applications
  • Usage of net/http for building HTTP servers in a Node.js application
  • Usage of OpenSSL for secure communication and encryption

Description​

Non compliant code​

require 'net/http'
require 'openssl'

uri = URI('https://example.com')

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.ssl_version = :SSLv3
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

request = Net::HTTP::Get.new(uri.request_uri)

response = http.request(request)

puts response.body

In the above Ruby on Rails code, we are making a HTTPS request to 'https://example.com'. This is done using the Net::HTTP library, which is a part of Ruby's standard library used for sending HTTP requests.

The problem lies in these lines:

http.ssl_version = :SSLv3
http.verify_mode = OpenSSL::SSL::VERIFY_NONE

The ssl_version is set to :SSLv3. SSLv3 is an outdated version of the SSL protocol and is known to be insecure due to multiple vulnerabilities such as POODLE (Padding Oracle On Downgraded Legacy Encryption). Therefore, using SSLv3 for encryption can lead to potential security risks.

Moreover, http.verify_mode is set to OpenSSL::SSL::VERIFY_NONE which means the certificate of the server is not being verified. This makes the connection susceptible to "man-in-the-middle" attacks.

In summary, the code is using an insecure encryption algorithm (SSLv3) and is not verifying the server's SSL certificate, making it vulnerable to various types of attacks.

Steps​

  • Replace the use of the insecure SSLv3 protocol with a more secure protocol, such as TLS.
  • Remove the line 'http.verify_mode = OpenSSL::SSL::VERIFY_NONE' to enable certificate verification.
  • Use a trusted certificate authority (CA) to verify the server's certificate.
  • Implement proper error handling and logging for SSL/TLS connection failures.
  • Regularly update the OpenSSL library to ensure you have the latest security patches.
  • Consider using a higher-level library or framework that abstracts away the low-level SSL/TLS implementation details.

Compliant code​

require 'net/http'
require 'openssl'

uri = URI('https://example.com')

http = Net::HTTP.new(uri.host, uri.port)
http.use_ssl = true
http.ssl_version = :TLSv1_2

request = Net::HTTP::Get.new(uri.request_uri)

begin
  response = http.request(request)
  puts response.body
rescue OpenSSL::SSL::SSLError => e
  puts "SSL connection failed: #{e.message}"
end

The updated code now uses the more secure TLSv1.2 protocol instead of the insecure SSLv3 protocol. The line 'http.verify_mode = OpenSSL::SSL::VERIFY_NONE' has been removed to enable certificate verification. This means that the client will now verify the server's SSL certificate against a list of trusted certificate authorities (CAs) before establishing a secure connection.

In addition, proper error handling has been implemented for SSL/TLS connection failures. If the SSL connection fails for any reason (e.g., the server's certificate is not trusted, the server's certificate has expired, etc.), an OpenSSL::SSL::SSLError will be raised. This exception is now caught and logged, making it easier to diagnose and fix SSL/TLS connection issues.

It's also recommended to regularly update the OpenSSL library to ensure you have the latest security patches. This can usually be done through your operating system's package manager.

Finally, consider using a higher-level library or framework that abstracts away the low-level SSL/TLS implementation details. This can make your code easier to read and maintain, and can also help prevent security vulnerabilities. For example, the 'httparty' gem is a popular choice for making HTTP requests in Ruby, and it handles SSL/TLS connections in a secure and user-friendly way.

References​

Last updated on