JWang748392 (Community Member) asked a question.
Mismatch (CWE ID 297) in android?
The first line triggered this issue and my fix below did not pass the veracode scan. I'm not sure the exact logic of the scan, e.g. do I have to fix this in SNI way? (SNIHostName serverName = new SNIHostName("www.example.com");
) So please suggest the solution if anyone has figured this out. Thanks.
SSLSocket socket = (SSLSocket)getSSLContext().getSocketFactory().createSocket(host, port);
List<String> hostNames = getHostNamesFromProperty();
verifyHost(socket.getSession(), hostNames);
public void verifyHost(SSLSession session, List<String> hosts) throws SSLPeerUnverifiedException, SSLHandshakeException {
if (hosts.size() == 0) return;
HostnameVerifier hv = HttpsURLConnection.getDefaultHostnameVerifier();
for (String host : hosts) {
// Verify that the certificate hostname is correct
// This is due to lack of SNI support in the current SSLSocket.
if (hv.verify(host, session)) return;
}
throw new SSLHandshakeException("Expected " + hosts + " , found " + session.getPeerPrincipal());
}
.png){kind=logo}
Hi,
In order to address CWE 297, we have 2 criteria to meet :-
Lack of hostname verification is another security flaw. Ensure that hostname verification is not disabled by development reasons.
SSLSocket does not perform hostname verification. It is up to your app to do its own hostname verification, preferably by calling getDefaultHostnameVerifier() with the expected hostname. Further, beware that HostnameVerifier.verify() doesn't throw an exception on error but instead returns a boolean result that you must explicitly check.
Depending upon what mitigation controls are implemented, you can accordingly raise a mitigation proposals on the same. If you require Veracode to confirm this. I would recommend you schedule a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif
Hi,
In order to address CWE 297, we have 2 criteria to meet :-
Lack of hostname verification is another security flaw. Ensure that hostname verification is not disabled by development reasons.
SSLSocket does not perform hostname verification. It is up to your app to do its own hostname verification, preferably by calling getDefaultHostnameVerifier() with the expected hostname. Further, beware that HostnameVerifier.verify() doesn't throw an exception on error but instead returns a boolean result that you must explicitly check.
Refer to this for details : https://github.com/OWASP/owasp-mstg/blob/master/Document/0x05g-Testing-Network-Communication.md
Depending upon what mitigation controls are implemented, you can accordingly raise a mitigation proposals on the same. If you require Veracode to confirm this. I would recommend you schedule a consultation call to discuss. You can check out this knowledge article (https://community.veracode.com/s/article/How-to-schedule-a-consultation-call) on how to schedule a consultation call with us.
Regards,
Kashif